Unconfirmed user limitations

[craigmcginley]

Need to think about what limitations unconfirmed users should have, if any, and what security / "abuse" concerns we may face.

[craigmcginley]

Devise has a filter built in... we could blank limit actions with before_filter :only_confirmed