require_confirmed_with to the password strategy block, I can still log in before visiting the confirmation URL in the email. Worth noting that I started adding AshAuthentication to my application before the Igniter installers were added, so my resources may be missing some optional-but-recommended blocks that the installers add.