Use the username, not email, as the lookup when verifying emails.

This makes more sense, since this is the key in the database, as well
as because usernames are unique, while we don't (at the moment) have
anything to prevent two users having the same email address.

Change-Id: I32efa3f8f5f988299ee8cdcf92652c9eb49a553e