It is possible to login unconfirmed authenticated users

Hi @LuisAlaguna, from my investigations, it looks like this is a legitimate bug. Have you already created an issue on Github?