missing login security check - login was not checking email address was

verified - also added additional check to cookie login in case of admin
change to account status