Expire new-account offers after 7 days

When we create a new user via the lobby API, we send them an email that they can use to set their password.

If they don't use this email within a week, we should expire it, and not leave the user around forever.