Had to update the CSS to accommodate this.

This gives us end to end flow!  BOOOYA!

prove.ejs -> verifyemail.ejs
verify.ejs -> verifyuser.ejs

urls are the same - verifyemail, verifyuser

This helps enable us to use the submit handler more easily as well as make sure we can validate correctly.

Starting on the differentiation between the createUser and addEmail flows.

Make sure the screen does not jump around, add a cancel button.

WSAPI CHANGES in preparation for new UX flows, specifically where you provide a password AFTER verifying emails.

  * stage_user no longer takes a password
  * after calling stage_user, you can poll status with user_creation_status
  * instead of 'prove_email_ownership', you call 'complete_user_creation' and provide a password
  * add_email is now 'stage_email'
  * after calling stage_email, you can poll status with email_addition_status
  * instead of 'prove_email_ownership', you call 'complete_email_addition' and provide a password
  * stage_* and complete_* calls are POST
  * *_status calls succeed continuously (not only once)