[wip] Issue 977 expired verification link

We're not able to have a resend verification link in all cases. It's only possible to resend the email if you have the `sessionToken`, which is only available in the browser you signed up with. Should we keep it that way or remove it altogether?

cc @pdehaan @shane-tomlinson 

Fixes #977.
`UNKNOWN_ACCOUNT` *can* mean the link has expired, i.e. you've created an account using the same email as an old unverified account but with a different password, which causes the old account to be deleted (thus unknown). The link could also just have a `uid` for an account that never existed.

`INVALID_VERIFICATION_CODE` means the format of the code was messed up, yeah.