auth - remove unconfirmed