missing login security check - login was not checking email address was
verified - also added additional check to cookie login in case of admin
change to account status