If an user is authenticated it should be impossible to get to the activate page
zdbfhkjbh
And the same applies to the login page
This is the login page
Make sure user can't activate their account twice
Check if firstname isn't null otherwise the user changed the md5 hash in the url

If First name is null make sure the submit button will never be enabled
Add some comments
Privatize and cleanup