`VERIFIED_EMAIL` should not take `verified` into account (closes #487)