This allows uploads to be very slow but still verification can almost always happen. Verify-only tokens are extremely harmless so we can give them a long lifetime. 

+ tests