ValidateClassification and RejectClassification do not require a user to have a verified email

Both the ValidateClassification and RejectClassification (which use the same 'moderation' mixin) do not have permission classes, but could have IsVerified. They both require writable corpora, but a user could have write access on something without a verified email and still moderate classifications.