Move email callback page under /on/email

This harmonizes with how we do accounts elsewhere, which email is
similar too, and binds the call to the logged-in user rather than the
participant from the path (/%username/).