Validate email before creating identity during sign-up and sign-in

Avoid Sentry exceptions when attackers try to stuff invalid emails. The
browser performs form field validation that should normally prevent this
from occurring, so we just return 422 without validation error messages.

Also:

- extract redirect_to_session_magic_link helper
- some controller refactoring and cleanup

app/controllers/sessions_controller.rb

@@ -9,17 +9,16 @@ class SessionsController < ApplicationController
   end
 
   def create
-    identity = Identity.find_by_email_address(email_address)
-
-    magic_link = if identity
-      identity.send_magic_link
+    if identity = Identity.find_by_email_address(email_address)
+      redirect_to_session_magic_link identity.send_magic_link
     else
-      Signup.new(email_address: email_address).create_identity
+      signup = Signup.new(email_address: email_address)
+      if signup.valid?(:identity_creation)
+        redirect_to_session_magic_link signup.create_identity
+      else
+        head :unprocessable_entity
+      end
     end
-
-    serve_development_magic_link(magic_link)
-
-    redirect_to session_magic_link_path
   end
 
   def destroy