verification sticks around in session; user can bail out before confirming
TODO: wip'd sign in message and device-recognition...
first-time users are never locked out while trying to confirm phone number