We could use a comment here about what comes back from the verifier. It took me a minute to grok why we removed email - I assume it is because the verifier could return either "email" or "unverified-email"