Feature: harden security model to (try to) protect against phishing

- [ ] Ready for merge

# Updated security model

To help protect against phishers, and have some accountability against illegal content.

## Use jsbin.io for iframe in full preview for security

- [x] Add domain to jsbin.com
- [ ] Sandbox in the same way the runner does
- [ ] New CSS for heading bar
- [ ] Opt in to security (in config.local)

## Registration has email validation

- [ ] Github authed users do not need to go through this step
- [ ] Show "Validate your email" in profile menu (does the menu item need a call to action?)
- [ ] Email (similar to forgotten password) with a token that matches up to an action
- [ ] Validated flag on user profile (`ownership`) (and email all users to auth their account?)
- [ ] Check email against stopforumspam.com api

## /quiet has limited access

- [ ] Only registered users can share /quiet links
- [ ] If you land on `/quiet`, it gets redirected to `/` if no access
- [ ] User profile menu allows user to authorise their account