validation phrase for email security

[heyjay44]

Purpose of this ticket:

1. give the user a signal they can use to determine whether or not to click the button in the email. This is implemented by: feat: verify legitimate claim↔︎redeem by assigning a random phrase during email validation #432
2. give us greater assurance that a person is who they say they are (not yet addressed by any PR)

[gobengo]

I think for both #1 and #2, we may need to think from a clean slate about what is appropriate for the access/authorize -> access/confirm etc flows, because #432 only modified the (essentially now deprecated) voucher flows.

#1 or #2 may be solved for in different ways, so might also be good to make them two distinct issues and we prioritize one above the other (and so we can discuss one in isolation from the other).

[travis]

Yep that's true, though from a user perspective not much has changed here - I'd probably need to copy the phrase generation code into the access/authorize handler but it should basically just work from there.

I do think we need to think about these from a clean slate though, especially given the UX changes @Gozala has been advocating for around capability grants - if we're going to have a more complicated UX after the user clicks on the email (in which they can select which capabilities they want to grant) we'll need to think about where this sort of thing fits in that UX.

[travis]

Worth noting that @Gozala proposed an auth flow that would supercede this: #723