Require verified email address to accept a crate transfer

[jtgeibel]

We should require a verified email address before a user can accept a crate transfer. Possibly we should not even allow the initial invite, though at a minimum we should not complete the transfer without a verified email.