yes, `account.createdAt` isn't available to the session token but since this endpoint only does anything for unverified accounts it is close enough.