ManageSelection does not require a user to have a verified email

The ManageSelection endpoint that implements ListSelection, AddSelection, RemoveSelection all at once uses the IsAuthenticated permission class. This is not wrong per se, but without a verified email, a user is unable to apply anything to the selection, so this is useless. The frontend should also be checked for missing user.verified_email conditions on selection buttons.