user needs to confirm email before their account is activated