Why is user w/ unverified email considered authenticated?