Send verification code in URL fragment, not querystring

The spec says that we will send the verification code in the fragment portion of the verification URL, presumably so that it will not be leaked in logs etc.  We currently send it in the querystring.