confirm email now takes a user id instead of using session