confirm user and change password
prevent creating user with an existing username
Replaced 'username' by 'email' and removed some auto-generated code
automatically log in the user after he confirmed with the token