Possible security problem

There is a possible security risk when activating users. In the activate() method, when you have the ID of the user and it's code, the code doesn't check if the code and id are from the same user. That could lead to wrong user activations, because you could send a code from another user(not very feasible, but still, it's a easly solvable security risk).