ensure grower and retailer controllers require authentication, and allow unconfirmed accounts to login for 7 days