Add 'lock' to prevent getTokenSilently to be invoked in parallel

[luisrudge]

Description

Today, the getTokenSilently method behaves like this:

• create an iframe
• attach a listener to the window to receive messages from the iframe
• when the message from the iframe arrives, it removes the listener and the iframe from the DOM

The problem we have today is that if you call the method concurrently, we can hit a race condition where, by having two iframes at the same time, the order of the response is mixed and by the time you try to remove the iframe, it’s already gone and it throws an error (#109).

This PR implements a 'lock' the current instance of the Auth0Client in all instances of your app (from the same browser) until the getTokenSilently call is finished. This enables us to always* execute the method once at a time.

• This is not a real lock. It's a best effort lock due to platform limitations. In mobile or when a tab is 'sleeping', it might be the case that the lock is not made correctly for that particular tab, that's when proper error handling (something we'll work on) will help.

References

fix #109

Testing

• This change adds test coverage for new/changed/fixed functionality

[joshcanhelp]

LGTM!

What's the package size increase?

[joshcanhelp]

Don't you mean:

import Lock from 'auth0-lock';

😆

[luisrudge]

geez. can you imagine that? 😝