add email verification, xsrf protection, improve auth