Add email query param to reset code path

This reduces any attack surface

src/oauth2views/account_setup.ejs

@@ -29,6 +29,7 @@ app.controller('Controller', ['$scope', function ($scope) {
         <form action="/api/v1/session/account/setup" method="post" name="setupForm" autocomplete="off" role="form" novalidate>
           <input type="password" style="display: none;">
           <input type="hidden" name="_csrf" value="<%= csrf %>"/>
+          <input type="hidden" name="email" value="<%= email %>"/>
           <input type="hidden" name="resetToken" value="<%= resetToken %>"/>
 
           <center><p class="has-error"><%= error %></p></center>