remove security hole
email confirmation