Check users are verified before they make changes

[joe-herbert]

Users can now verify their email but that's not used anywhere so it's currently a useless feature. This could be added to middlewareAuth so they're essentially treated as not logged in until they verify