Not Verify email

Confirming a new account is /verify. Forgot does not send a verify code.

After signup, web lands on /verify. That flow uses a different hashed row than password reset.

Do not mix the verify code with the reset code.