Feature: harden security model to (try to) protect against phishing

- [ ] Ready for merge

To help protect against phishers, and have some accountability against illegal content.

Over time, jsbin has had more and more reports of phishing. There is simple blacklisting support in jsbin, but in recent weeks there's been an increased abuse.  There used to be a report abuse button, but this alone wasn't enough (and indeed most people entered their email address thinking they were signing up).

The main part of this work will simply mean validation of user's email address, and blocking of /quiet for non-registered users.

### Use jsbin.io for full preview for security

- [x] Add domain to jsbin.com
- [x] Sandbox in the same way the runner does
- [ ] New CSS for heading bar (rather than just the "edit in jsbin" button)
- [x] Opt in to security (in config.local)

**Update** if we frame inside an iframe, this breaks previewing in mobile, because the viewport is carried up. Damnit.

### Registration has email validation

- [x] Github authed users do not need to go through this step
- [ ] Show "Validate your email" in profile menu (does the menu item need a call to action?)
- [ ] Email (similar to forgotten password) with a token that matches up to an action
- [ ] Validated flag on user profile (`ownership`) (and email all users to auth their account?)
- [ ] Check email against stopforumspam.com api

### /quiet has limited access

- [x] Only registered users can share /quiet links
- [x] If you land on `/quiet`, it gets redirected to `/` if no access
- [ ] User profile menu allows user to authorise their account

### Misc tasks

- [ ] Preview uses preview url