Reworked activation process

The activation process is now divided into two public methods of
registrar. This leads to better readable code and fixes a potential
security hole when the activation page has to receive a user id to find
the user.
So now every public activation should go via
Registrar::attemptActivation($data)
The underlying system will throw different exceptions of a lot of
possible errors.