user has to confirm their account before they can log in