docs: mark the two calls that fail unless the account email is verified