Fix #5 no longer activate accounts after token expiration

NDB_USERS_ACTIVATION_DAYS now works! In `LoginActivate` request handler, we now check that the `UserActivation.expires` value comes after today (now).