For manual (non-social) logins, require a verified email address

This is to make it slightly more difficult for malicious users to create
accounts - they at least have to use a valid email address.