fix: only create or update the email / phone identity after it's been verified (again)#1409