> And somehow, without access to Twillio's API, they defaulted to not do any check at all? I guess you could imagine user accounts being created with `authenti

> And somehow, without access to Twillio's API, they defaulted to not do any check at all? I guess you could imagine user accounts being created with `authenticated=null`, and then having `authenticated=False|True` set in the in the success handler for some Twillio API call. Having null as the default would allow you to see in the database where authentication emails hadn't been sent out, so you could resend them. And then I guess you could imagine a developer checking authentication by looking for cases where `!authenticated`, rather than `authenticated == True`. Granted I don't think this hack is real, but if it were then that's probably how it would play out.