fix(auth): users with unverified email shouldn't log in + feat(auth/completeProfile): respond to json

Fixing a bug when users could login immediately without verifying email.
+ making profile completion endpoint respond to json