Add explicit route to match /user/activate/ only, update activate action to catch null token