non-opted-in users should not be able to go to the verification page
attempts form feature (Gringotts::Attempt model/migration/factory/spec)
attempt.user_id should *not* be unique (obv. multiple attempts per user)
verification attempt POST route; strong params