user must confirm email to sign in