Added security check on /confirm route