Preverification API

Do we need another permission class to check if the user is verified? I'm not sure if that should be a `400` or