Alternatively we could fake `otp_verified()` on `User` but IMO this way is cleaner. Or support `User` objects without `is_verified()` but IMO that's making code work for an invalid case.