user verification has an extra step