Enforce email confirmation before login
Right now, we send an email confirmation, but don't check if the email address was confirmed before granting users authorization to login.
We need to find a way to enforce this on new instances, without breaking login for existing users.