Email verification belongs at the API boundary

Email verification should protect the API capability that needs it, while leaving sign-in, recovery, and account management usable.