Q:

New user validates without confirming email

I've built a plugin that does some work before saving the user from the standard Registration Form. My only issue is it does not fire the activation email which I added in. But it lets the user login without verification, so I'd like to know what I'm missing as I thought if I use craft()->users->saveUser() it automatically deals with this for new users. My code is as follows I think I may be missing something from the model?
$newUser = new UserModel();
$newUser->username = $username;
$newUser->email = $email;
$newUser->newPassword = $password;

$success = craft()->users->saveUser($newUser);

if ($success)
    {
        // Code added to send email
        craft()->users->sendActivationEmail($newUser);

        $this->redirectToPostedUrl($newUser);
    }

A:

Since you're bypassing Craft's own UsersController->actionSaveUser(), you'll need to replicate a bit more of its functionality in order for it to work like you're wanting.
First you'll want to make sure that "Require Email Verification" is checked under Settings->Users->Settings in the control panel.
Then your UserModel will also need to set a few more things:
$user->unverifiedEmail = $email;
$user->pending = true;

Completely untested, but that should do it.
I highly recommend looking over Craft's default actionSaveUser implementation as there are many permissions/security guards in place for public registration that you should probably consider as well.

