Success action now validates that the user is signed in

and then redirects them back to the success action
this prevents people not logged in from not confirming
their back