redoing r38040: two new hooks for email confirmation/invalidation, both are in User...