build in security/email confirmation, restrict admin status