Why is user w/ unverified email considered authenticated?

Gotcha, just posted a GitHub issue.