Add a validated flag on user accounts to determine whether the email
has been confirmed. Log in is not possible otherwise (openid/oauth
signups set this automatically.)

Various additions and improvements to the signup procedure, implemented
email confirmation, much more polish needed.
Various cleanups
Add a migration file for SQL changes