user should not be able to change password, delete account, link oauth, and more when they havent verified their emial. This is for security reasons.