Require confirmed email when checking oauth token (#332)

* move token checker to security package

* update tests with new security package

* add oauth token checking to security package

* check if user email confirmed when parsing token

internal/oauth/util.go

@@ -85,6 +85,9 @@ func Authed(c *gin.Context, requireToken bool, requireApp bool, requireUser bool
 		if a.User.Disabled || !a.User.Approved {
 			return nil, errors.New("user disabled or not approved")
 		}
+		if a.User.Email == "" {
+			return nil, errors.New("user has no confirmed email address")
+		}
 	}
 
 	if requireAccount {