text: Title: api: accept auth action codes without (or with incorrect?) base64 padding (=)
  Body: Some users' email agents don't recognize that `==/` may be part of the account activation URL, for example, and receive `400 Bad Request`. We should fix the padding automatically if that happens.