ShowEmailRecord is a common link to hand out.

Since it takes arguments, it triggers the CSRF warning, but it's a
readonly page and it's common to tell someone "Here's a copy of the
email that went out" - so let people visit it directly.
Merge branch '4.0/whitelist-showemailrecord' into 4.0-trunk