At first I thought it would be better to not save the verification code until we know that the email had been sent, but this is backwards. It's better to have cruft in the database than for someone to get an email and not have the verification code work. Realized this as I was creating a model with knex + objection.