Allow both unauthenticated long verification codes or short logged in codes for email confirmation

See https://security.stackexchange.com/a/169625/95909

This will require changes to the frontend as well. Addresses https://gitlab.com/passit/passit/issues/33

I also added a request new confirm code for passit#35 (closed)