Exactly.

We know the user is authed as **mismatch**, we want to make sure they own **claimed** email.