* set email addresses in Newuser.js, also add status for players,
  set to unverified initially, and disallow login unless status is
  active (note that this is currently broken because there's no way
  for status to become active)