fix(auth): users with unverified email shouldn't log in