Validate users before confirming new accounts

[christad92]

For security reasons, we enforce that new users should confirm their account by sending an email with a confirmation URL. When users click the link, we don't check their identity before confirming the account. (they just say click on the confirm account button)

The proposal is that when a user clicks a valid confirmation link, we should confirm their identity by asking them to sign in or checking if a stored user token validates their identity.