add email confirmation and require users to activate account before first login re: #30