authenticate with unverified email and allowUnverified

fixes #2902