Attempt to validate macaroons

[illicitonion]

A couple of weird caveats:

• If we can't validate your macaroon, we fall back to checking that
  your access token is in the DB, and ignoring the failure
• Even if we can validate your macaroon, we still have to hit the DB to
  get the access token ID, which we pretend is a device ID all over the
  codebase.

This mostly adds the interesting code, and points out the two pieces we
need to delete (and necessary conditions) in order to fix the above
caveats.

[NegativeMjark]

Slightly concerned by the s/user/user_id/. We fairly consistently use "user_id" when passing a str, and use "user" when passing a UserID object.

I'd prefer better names, but I'd rather keep consistency with the rest of the code.

[illicitonion]

Done

[NegativeMjark]

LGTM