update users so they must be confirmed. also lock after multiple failed attempts
erb -> haml
production assets tweak