deprecate smtp.verificationUrl and passwordResetUrl

I've left the `routes/util.js` endpoints to continue servicing links in the wild, but they should be removed eventually.

I also left the previous config options in place so existing config files will not explode. The next release after this gets merged should remove these.