Unexpired confirmation token can be exploited and results
in account take-over. Also reduce unconfirm access time to
avoid exposure to spam.