Use HTTPS in the activation link emailed to the user. (#560)