Add some basic email validation

A start at sanity-checking email addresses, per #402.  I also refactored our custom validation regexes into a shared module rather than duplicating in each route file.

@dannycoates r?