Fix exploit where you could use an empty hash to activate your account.