Refactor API key storage in the database.
Several API verification improvements.

* Password reset should now work if the original API key used to
  verify the account expired or has been deleted;

* It is now possible to unverify an account on the settings page;

* Lowered constraints for API keys: mask can be anything as long as it
  supports AccountStatus, also Account-type keys are now supported.