Fix verify confirm

- replace 'base64' in encryption with url safer 'hex'
- add ACL for 'confirm' link sent by email
- 'from' field was not included in verify email sent, this is necessary in some environments (such as AWS SES) where from address must be specified