#8601 email auth verification by link
With a link we can have a longer token for more security (still type-able if needed). And the link will defeat some MITM phishing attacks, forcing you to the right site.
We can apply this to 2FA accounts too (currently being skipped) so they get the MITM protections too
Downside is if you don't have email access on the same computer you're logging in to :(
db/8601
looks good, merged.
There are a few more improvements we could make, but this is a considerable step in the right direction.