Sending email was missing the from field
using base64 caused an occasional token string to contain '+' which resulted in a space being embedded in the token.  'hex' should always produce a url safe string for the token.
fix to enable ACL for confirm link sent by email
Update user.js

Corrected spacing on confirm ACL, removed extraneous comment on using hex rather than base64
Merge pull request #219 from dougtoppin/fix-verify-confirm

Fix verify confirm