Yep!

It would be helpful to have this mentioned.

Dumb question, is it a 'risk' to leave the code in your profile? As in someone could crawl profiles looking for Kismet codes and then altering random people's profiles. If so, maybe it would be worth it to add text suggesting that people remove the code from their profile after verification is complete? Cheers

The verification code and the auth code for your profile are different and are generated in a different way, so it's pretty low risk to leave it.