add devise confirmable and make it controlled by a config variable. closes #337