Not verified? /auth/verify gerekir (token auth log’da).