Add fields confirmation_token and confirmed to User
Send a token based email confirmation mail on signup

Login in user after signup without confirmation
But ask for confirmation on next login
Use token to identify session instead of id
Include pundit gem and serialized roles column for User
Send confirmation email with unique token
Use one-time-token in session to identify user
Add serialized field roles to user and include Pundit