Email verification (minus the minor 'actually sending email' part)