how to implement the following flow: a user signs up/logins via email/apple/google, buut later decides to attach a phone number to the user profile (not for the auth, but still needs to verify the ownership via sms)