Changed registration flow to first send email verification link that

when visited sends sms code for second step of account verification.

At that second step user enters just sms code sent to users mobile
number.

Also moved dao calls that simply proxied calls to client to calling
client directly.

There is still a place where a user will be a sent a code for
verification to their email namely if they update email address.

config.py

@@ -35,10 +35,11 @@ class Config(object):
     ADMIN_CLIENT_SECRET = os.getenv('ADMIN_CLIENT_SECRET')
 
     WTF_CSRF_ENABLED = True
-    SECRET_KEY = 'secret-key'
+    SECRET_KEY = 'dev-notify-secret-key'
     HTTP_PROTOCOL = 'http'
-    DANGEROUS_SALT = 'itsdangeroussalt'
+    DANGEROUS_SALT = 'dev-notify-salt'
     TOKEN_MAX_AGE_SECONDS = 3600
+    EMAIL_EXPIRY_SECONDS = TOKEN_MAX_AGE_SECONDS * 24 * 7  # one week
 
     DEFAULT_SERVICE_LIMIT = 50