#6 An administrator cannot manage unverified users

Instead of calling 
```javascript
dao.deleteMatching(...)
```
 use 
```javascript
dao.deleteById(vars.id, 'unverified_user').then(...)
```

It will handle the conversion of a string ID to ObjectID for you and keeps the DB specific stuff at the DAO layer