implement a way to ban email addresses
In the last donate card testing attack (#19), Stripe claims that hundreds of attempts came from the same email address. now, it's possible this is misreported (like the IP address, #20), but if it isn't, we should just block that email address already.