Stub out change to email type

Instead of an `address` text and a `confirmed` boolean, how about two
texts, `verified` and `unverified`? Resolves the nomenclature mismatch,
for one. More importantly, we can then avoid clobbering an old verified
email in the case where the user never verifies a new address.

I ran out of time before I could update the code to work with this new
schema, but I wanted to push this commit in case someone else wants to
pick up with this before I get back to it.