user must confirm via email to log in
fixed confirm url