Validate user when submitting the public key

[mronkain]

The POST request that adds the key isn't very secure: it is trivial to replace someone else's public key. The request should contain some session id or simply the confirmation token to make sure that the key is added to the same email that was confirmed earlier.