Make user#confirm_resend require a valid token in the session that matches the requested user, and ensure trying to login as an unconfirmed user sets such a token. Fixes #1010