sync with yii-usr; don't require setting up url rules in app config; don't allow password recovery for disabled accounts; regenerate activation key after using it