Best Practice of Enforcing Email Verification