Add an option to honor emailVerified

/to @ritch or @bajtos 
The PR should supersedes https://github.com/strongloop/loopback/pull/215
When `assert(err)` throws, `emailVerificationRequired` is not reset back to `false`. It should be enough to swap the order of L178 and L179.