Added user SSA token verification plugin

Added an SSA verification plugin to restify that transforms the `_user` token, when present, to an email address, setting the `_email` param of the request object on success. If that step fails, it automatically returns a `403 bad_user` response. 

Adopted use of this new parameter in every API endpoint that was calling `auth.verifySSA` manually. Less boilerplate code, yay!