Update phpass to v0.3
I18n of views, page names and form validation messages.
Don't destroy the session on logout().

Tank Auth is not the only thing to store data in there, so killing the session kills every other piece of data stored by other parts (like CI's Cart).
Logout the user after sending the confirmation email.

Otherwise a new user get stuck logged in with an non-activated account.
Mark email fields as type=email.
Use our own method instead of going through the session directly.
No need to load 'security' when running CI > v2.1.0

Security was moved to CI's core in v2.1.0 and loading it twice triggers spurious logging.