Create a 'status' based user state-machine for testing and implementation of the signup-confirmation.
It seems that the solution is too complicated for the use case, but it's good learning new stuff. Also, I got it to work regardless of the strict password validation without hacking the validations themselves (at least on the committed code). And the migration is 'change' based and reversible, which is great.
I have the feeling Devise would be taking care of this for me, but that's why this is called learning.
Added some form of verification emails with a verification step page.
No tests are available yet (I know).
Application configuration is private and produced during deploy:setup (for capistrano). This needs to be improved to allow easy Heroku deployments as well.
Sign in is not possible until activation. Users are not shown until active (well, more or less, there are some gaps that need testing and implementation).