does not allow user to log in if not verified