New accounts and linking a login to an existing account MUST go through email verification. We cannot trust the emails we get from oauth providers have been confirmed. Part of MDL-58220