[update] Now the user needs to confirm the email address