users now forced to confirm email