chore(uservalidationbyemail): cleans up implementation

This moves the page handling logic to separate scripts and also
replaces direct `$_SESSION` access with the elgg_get_session() API.