fixed user confirmation urls