Adds clarity to `verifyEmail` docs, noting that the token for `forgotPassword` is different. Fixes #10236