set confirmation token when user is created
fix session checking
add header