Both signup forms can create a fully verified account with no identity check and no
Didit session. Those accounts are stamped verification_method = didit so
they behave like real ones, and carry dev_bypass = 1 so they can be found.
Set HP_DEV_AUTO_VERIFY to false in includes/dev-auto-verify.php
before launch.