Sbt with or without jrebel
User authorization only checked after password check, and new page with email instructions