catch and warn about missing email_from_address
encode username in utf-8, fixes UnicodeDecodeError on login
check for transition, not new_state
added workflow state pending_phase_2 incl. transitions and notifications, refs #8827