verifying is now done from the user object itself (incl. db store)