Fix some bugs in modified user mapper
Fix variable typos when setting up the sync verification nonce
Require user to use login form to verify the Memberful sync link

This prevents an attacker from forcing the user to start the OAuth flow,
then "completing" the verification by using some other kind of SSO
service.
Ensure that the member is linked to the correct user after sync link

The checks at the top of the method verify that the user has authorized
the link. Follow-up commit will double check that the user who verified the
link is the one who is being mapped to.
Be explicit that user verifying link is the one being linked

In theory this isn't necessary as the the linking information is
retrieved from the meta of the user who signed in, but it doesn't hurt
to be a little explicit.