get_user_by_id: ensure obj_id is ObjectId.
get_user_by_mail: ensure mailAliases is verified.

Old code would treat all mailAliases as verified if one of the
users mailAliases were verified. Using mongodb query was just a
bit too simplistic.