If your site sends me a password reset email and I reset my pw, you don't then need to separately confirm my email address (cc @dropbox)