Email verification

Whenever a user account gets created (from an unauthoritive source) or a user updates
his email address, we will ask them to verify it. This works by sending an email to
the user's (new) email address that contains a link with a special token.

When the user presents this token to the backend we mark the email address as verified.