Move it into `user.meta` (which implies adding a new field `meta`, ***mixed type***).

On POST /session, check if `emailVerified` meta is present, store value in session.