(CE-753) Use normal login method on confirming email

This avoids replicating the code that sets and clears login tokens
and so forth, while letting the login be stopped by hooks when needed.

Also adds a login token which should be checked whenever a user is
logging in as an anon.
Merge branch 'CE-610-CE-753' into CE-610