add db.flush after creating new Activation

This will prevent URLs being emailed that look like
http://localhost/reset_password/None