Users need to be verified before they can get an access token