If we're only storing the first 32 characters of a 64-character hash, isn't it possible to have two hashes that are not unique?

Why not add a unique index to the activation_token field and catch a PDOException on insert that indicates a unique key problem?