restricting login to confirmed users only