user is signed in via confirmation email