disallow sign in if not verified