use after_set_user to handle confirmation link