Make EMAIL_VERIFICATION default to 'mandatory'.

According to the documentation, email verification should default to `mandatory`, although the current implementation returns `optional` by default. The wording in the documentation suggests that one has to actively choose to disable verification or to make it optional, therefore I changed the implementation according to the docs and not the other way round.

> When set to "mandatory" the user is blocked from logging in until the email address is verified. **Choose "optional" or "none"** to allow logins with an unverified e-mail address. In case of "optional", the e-mail verification mail is still sent, whereas in case of "none" no e-mail verification mails are sent.