Add authenticty_code (for cookies) to User. Require confirmation_code to be present, change test