title: prevent users without confirmed email from logging in ASP.Net MVC with Identity 2
body: <p>In microsoft Identity 2 there is ability to users can confirm there email addresses I downloaded  Identity 2 sample project from <a href="https://www.nuget.org/packages/Microsoft.AspNet.Identity.Samples">here</a> in this project there isn't any difference between users confirmed their emails and who doesn't I want to people how don't confirmed their emails can't login this is what I tried :</p>
  
  <pre><code>public async Task&lt;ActionResult&gt; Login(LoginViewModel model, string returnUrl)
      {
          if (!ModelState.IsValid)
          {
              return View(model);
          }
  
  
          var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: true);
          switch (result)
          {
              case SignInStatus.Success:
                  {
  
  
                      var user = await UserManager.FindByNameAsync(model.Email);
                      if (user != null)
                      {
                          if (!await UserManager.IsEmailConfirmedAsync(user.Id))
                          {
                              //first I tried this.
                              //return LogOff();
                              HttpContext.Server.TransferRequest("~/Account/LogOff");
                              return RedirectToAction("Login");
                          }
                      }
  
                      return RedirectToLocal(returnUrl);
                  }
              case SignInStatus.LockedOut:
                  return View("Lockout");
              case SignInStatus.RequiresVerification:
                  return RedirectToAction("SendCode", new { ReturnUrl = returnUrl });
              case SignInStatus.Failure:
              default:
                  ModelState.AddModelError("", "Invalid login attempt.");
                  return View(model);
  </code></pre>
  
  <p>I tried to force user to Logoff by calling LogOff() action method but It didn't work and user remain authenticated .then I tried to use <code>Server.TransferRequest()</code> but I don't know why it did the job but it redirects users to login page with returnUrl="Account/Logoff"
  so after they confirmed their email and tried to login they get logoff I get really confused!!
  this is my LogOff() action method:</p>
  
  <pre><code>    [HttpPost]
      [ValidateAntiForgeryToken]
      public ActionResult LogOff()
      {
          AuthenticationManager.SignOut();
          return RedirectToAction("About", "Home");
      }
  </code></pre>
  
  <p>I have googled it for days without any luck !!!!</p>