Fix the bug that user can still login without confirming their email.