Do not generate confirmation_token on create

generate_confirmation_token touches sent_at timestamp so generating a token on create makes sent_at timestamp useless. I would also remove sent_at timestamp, but you probably added it for some reason.