The PR improves (hopefully) on the way authenticated actions are processed. User.is_active is now nullable, with the null value representing pending activation. Activated users have is_active = True, and locked ones have is_active = False, as before. Users which have not logged in and previously had is_active = False are pending activation (in the old scheme) and are migrated to "null".

Authenticated actions now only can be performed by active users (except account activation, which only requires that is_active != False, so null is fine). Locked users cannot perform any authenticated actions any longer.

The PR also adds User.email_verified which is set any time an auth action code is presented and passes the serializer validation. This means that the code is structurally valid and not expired (this includes cases where the action is not executed because the user is locked, but the code was otherwise valid).

We started verifying email addresses on Oct 23, 2019. Users which signed up on or after this date and have is_active = True or have logged in at least once have email_verified set to created. (The last case covers locked users, for which we set is_active = False manually at some point.)

rebased on top of #592, i.e. first commit doesn't actually belong to this PR

Alright, this time ready for real. Did some minor tweaks here and there, added some unrelated bug fixes, and put all the commits in right order.

Note the one comment above. While at it, maybe add an example for how to use this to README?