Add authenticate_user to all User actions except new and create
Add admin option to confirm or unconfirm users