A user should be notified that they have registered and be forced to confirm their email before they are allowed to sign in.