use POST to /api/users/activate
do not return json, head only