activation now nulls out authToken; activation landing page now POSTs to a form processor that validates CSRF and activation logic.
landing page built.