Don't clear confirmation token, redirect to sign-in on repeated confirmation attempts