AFAICT the only place a user gets to know that verification emails expire after one week is after clicking a no longer valid email. Nothing in the email tells them that there's any time limit, so that can be a nasty surprise. We should probably specify the expiration time in the email and that they can request a new verification link from /account/edit either also in the email or as part of the expired email error message.