fixed typo in appsecurity, add option to guard route via a confirmed fla...

Did not make any routes require email confirmation, but it is a fairly common requirement. Adding `confirmed: true` to a route is all that is needed.