Require email address verification

[pcantrell]

This is a spam prevention measure.

I’d suggest letting people go ahead and create their sessions with an unverified email — don’t stop the momentum! — but hide them (with a warning message) until the email address is verified.