Filter verification code lookups on user.

More than one user might claim they have a certain phone number,
so the database lookup needs to filter on the user currently trying
to verify the phone number.