User self-serve signup

Users should be able to sign up with an e-mail address that is verified before they can log in.

Out of scope: limiting sign-ups to specific domains, user profile page, obscenity filter, deduplicating existing (SSO) accounts with the same e-mail address.