Fix no confirmation is allowed.

when `allow_unconfirmed_access_for` is set to `0.days`
and `confirmation_sent_at` is any day after today (include today)
the `confirmation_sent_at && confirmation_sent_at.utc >=
self.class.allow_unconfirmed_access_for.ago`
will always return true.

This patch check for 0.days case and return false immediately.

fixes #3244