now requiring users to confirm their email address before doing anything else