resolves #33, regenerate activation key after it has been successfully used to prevent reply attacks; added controllerMap to avoid the need to specify custom url rules in app config