Email addresses are leaked by sign up process

[grodin]

If the email address already exists, we display a message to that effect. See [this security.stackexchange question][1] for more details and a way to avoid this. Will require email validation flow.