authenticate with unverified email and allowUnverified

fixes #2902
Merge pull request #2907 from seanmonstar/2902-reuse-unverified-email

authenticate with unverified email and allowUnverified