Issue #876: don't let social logins hijack accounts through unverified email addresses.