generate a link for each user (bug 1074518)

- [x] add in signing of state code when ready
I think there's a `urljoin` helper in `urllib` or `urlparse` that will ensure you don't get a double slash in there if the thing you're prepending ends with a slash. Probably won't happen so I'm happy with it as is. Up to you though.