Fix for security issue that means the entire login process can be bypassed

By going to /confirm.php?auto_login=1&member_id=X (X replaced with a number), it is possible to login as any user of the system. 

I've just added a requirement for the same 'confirmation code' to be required in the $_REQUEST global variable as is needed as part of the confirmation process.