Send verification code in query string, not url fragment.

Like it says on the tin, per #398.

This basically just reverts 1506ed0eb17ca82dfae58f7ee29eaf25b37b84c5.  I think that the content-server should still work with this change landed, as it looks for the code in both places.