email verification works end-to-end