-- Passwordless auth: the only way in is a magic link emailed to an address
-- (see EmailVerifier / AuthController::requestLoginLink). Opening a link both
-- creates the account (if it's new) and signs the user in, so an authenticated
-- session now always implies a verified email -- there is no more
-- authenticated-but-unverified state to nag about.
ALTER TABLE users DROP COLUMN password_hash;