Required email feels more "correct", still some work to do though for working with expired certs cleanly.

* Changed the state machine so pushing a state to the stack is optional.
* Changed the verify_primary_user screen to have an optional cancel button
* Updated required_email to handle primary verification of unauthenticated users.