wip: first pass at including space did info in verification email

[travis]

First pass at including space DID info in verification email, per #259:

I think this is unsatisfactory - DIDs aren't designed to be shown to humans and people will likely mostly ignore them. There are a number of potential solutions:

1. Just be ok with showing DIDs to users for now and figure out a more user-friendly solution later. This is probably ok - users who care can look at the DID of the space they just created and then eyeball it against the one in the email.
2. Use Gravatars of DIDs in the email. We'd need to massage the messaging to make this easy for users to understand, but @alanshaw demonstrated how it can be done in feat: example space manager w3ui#128
3. Show the name of the space the user just created. A couple problems with this:
   a) I don't think we save the name outside of the user's browser at the moment (tho could be wrong.. hope I'm wrong?!)
   b) users might have multiple spaces with the same name, so this may not be unambiguous

Opening this draft pull request to kick off discussion and design of how we actually want this to work. Please weigh in!

[jchris]

I think we should coalesce around gravatars for consistency. Maybe we can also pass the space nickname from browser via UCAN through the protocol like #291

[Gozala]

Few notes:

1. There is only accept option and nothing about the case when you have not requested access. We should at least tell user not to click it or better yet have a deny button. Often they tend to be red buttons or red text so to bring the attention.
2. This made me realize that auth the way we do it now over websocket, is not ideal because:
   • Attacker may attempt to get access to user space by making them click the validate button.
   • With redirect link back to site we can avoid this problem, because even if user clicks the link they authorize agent in the target site as opposed to whoever issued request.
   • This also makes me wonder if attackers may fabricate their own emails with URLs to their site to gain access to the account
3. I realize this designed for voucher stuff and not accounts but perhaps it's a good idea to consider later as that's where we going to go next.
   • There we don't have a notion of registering space
   • Instead you authorize agent to act on behalf of your account
   • DID would be a agent DID not the space DID
4. I think some visual like gravatar would be a lot more helpful that printing out DID
   • Most gravatars sadly look lame, but urbit designed some remarkable beautiful ones I wonder if we could do something along the same lines

[travis]

oo for posterity, I found the quote I was looking for that forms the basis of my feeling that showing the DID to the user is bad:

"If we ever show a DID to a user we have failed."

I don't think there's any disagreement, but worth thinking about in this context: https://github.com/cwebber/rebooting-the-web-of-trust-spring2018/blob/petnames/draft-documents/petnames.md

[gobengo]

this looks like a small patch that adds some functionality and not much risky.

@travis do you think it's still useful? If so we can spend some time tomorrow making the tests pass to merge

[hugomrdias]

I think we should revisit this after or during implementation of providers and accounts in our current phase.

[travis]

closing in favor of the work in #399