use confirm! instead of confirm_by_token