Moves user activation from just clicking on reset password to following the link in the password reset email

@shnayder @cpennington , or whomever else you may want to suggest

Something I hacked up "in my spare time".

I always thought that being able to activate your account just by clicking on `reset password` was too easy of a way to bypassing email validation.  It's right there on the profile page!

This fixes moves the user activation into the handler for clicking/cut-and-pasting the hashed link that gets sent over email.  Rationale is that this obviously confirms that the user owns the email address.

Sort of a draft PR to see if you guys want this change.  If you do then I can add tests, etc, to make this PR more mature.