since we're adding `verifierSetAt` I think we should add it to the "getter" `db.sessionToken` too.