fixed generation of confirmation url
refactored authcontroller
added access control
fixed cs