server side user auth validation
**basic** email sent with registration. **probably needs more robustness in later phase
end of day, set up logins for verified and unverified users (so dont have to hack passport authentication to cehck hypothetical 'verified' column)