return a more self documenting result
treat 0 length conf tokens as no token.

This is mostly for debugging purposes, and to handle the vagaries
of null versus empty string in the database.
Clear email confirmation token on cofirm.
conform to api stds of rest of app.
Don't send new confirmation if already confirmed

This edge case would hopefully be blocked by the UI,
where we first check /handlers/email_confirmation.ashx (GET)
to get the confirmation state, _and then_ present the ui
for sending a confirmation email.