'Given an email address and a nonce as strings, return a three-tuple:
- a ``VERIFICATION_*`` constant;
- a list of packages if ``VERIFICATION_SUCCEEDED`` (``None``
otherwise), and
- a boolean indicating whether the participant\'s PayPal address was
updated if applicable (``None`` if not).'

def finish_email_verification(self, email, nonce):

    _fail = (VERIFICATION_FAILED, None, None)
    if (u'' in (email.strip(), nonce.strip())):
        return _fail
    with self.db.get_cursor() as cursor:
        record = self.get_email(email, cursor, and_lock=True)
        if (record is None):
            return _fail
        if (record.nonce is None):
            assert record.verified
            return (VERIFICATION_REDUNDANT, None, None)
        if (not constant_time_compare(record.nonce, nonce)):
            return _fail
        if ((utcnow() - record.verification_start) > EMAIL_HASH_TIMEOUT):
            return _fail
        packages = self.get_packages_claiming(cursor, nonce)
        paypal_updated = None
        try:
            if packages:
                paypal_updated = False
                self.finish_package_claims(cursor, nonce, *packages)
            self.save_email_address(cursor, email)
            has_no_paypal = (not self.get_payout_routes(good_only=True))
            if (packages and has_no_paypal):
                self.set_paypal_address(email, cursor)
                paypal_updated = True
        except IntegrityError:
            return (VERIFICATION_STYMIED, None, None)
        return (VERIFICATION_SUCCEEDED, packages, paypal_updated)
