It is possible to login unconfirmed authenticated users

I think it requires more control workflows instead.