Setup recovery blob before verifying email

This PR represents the client-side changes to support ix-340;  namely, it moves the generation and storage of the recovery blob to before we make the verify email call (which burns the client side portion of the recovery token that is stored in fbgive).

With this PR, the wallet server can be in a failed state and a user will no longer get a false-positive that they have enabled password recovery. 
This case needs to reject to prevent the promise chain from continuing.