disallow login if email not verified