Nice catch.  Will fix.
On Sep 25, 2013, at 12:13 PM, Jay Zoldak <notifications@github.com> wrote:

> In lms/djangoapps/shoppingcart/views.py:
> 
> > @@ -80,6 +84,9 @@ def postpay_callback(request):
> >      params = request.POST.dict()
> >      result = process_postpay_callback(params)
> >      if result['success']:
> It proves that they're real, but it doesn't prove that they are in control of the email address that they signed up with. We shouldn't circumvent the activation flow.
> 
> —
> Reply to this email directly or view it on GitHub.
>