now redirects to :confirm_url