In php it would be trivial (and expected) to have a `string` type on a parameter that's expected to be a string - thus negating this issue. But then using the

In php it would be trivial (and expected) to have a `string` type on a parameter that's expected to be a string - thus negating this issue. But then using the email address from the request rather than the already verified address in the DB seems like a weird design decision to me anyway.