Login Denied Flash

Resolves a denied_ref from the login page's own URL fragment (see _create_login_denied_flash's docstring) back to the refused email, EXACTLY once -- the row is deleted by the same statement that reads it, so a replayed or guessed token answers 404 like one that never existed. Unauthenticated by construction: the person reading it is, by definition, not signed in. token is a random opaque reference, never derived from the email, so it carries nothing worth protecting on its own.