added check on if user.emailVerified=true  on login, so that newly registered users cannot just login to site  without anyone verifying (either themselves or admin)