validate hash-delivered email addresses

This moves the assignment of params.email from the primary-controlled
URL hash (#CREATE_EMAIL= and #ADD_EMAIL=) into the verification block,
and adds bid.verifyEmail() to check them. Closes bug 758449.