Fix: confirmation code is generated before email is sent