Optionally require email validation before account is usable.

It's always a good idea to validate an email address that a user gives in conjunction with an account. These changes allow this check to be turned on and off via the 'verify-email' property in `app.js`.

When enabled, new user accounts will be created with `isActive` set to `no`. An email will be sent containing a link for the user to click on. When the user selects the link, they are required to enter the email address they used to sign up. After this step, the original welcome email is sent and the user is marked as active.

These changes also affect accounts created using the FaceBook, Twitter, or Github signup paths. Additionally, the changes fix a defect where socially linked accounts could log in even if the account is marked as inactive.

(Feel free to tidy up my code as needed. I'm not a JS guru by any stretch.)