verify email using mailgun before mailing out

introduces a new env variable called MAILGUN_API_KEY, which should be the public mailgun key (not the private one)
I think we'll want to die if we get an error back from the validator, but we should be checking `res.is_valid` for the validity of the email