Loginhash should invalidate after first login

[AndreasA]

Hello,

personally I think that the login hash should invalidate after first login.
Furthermore the login hash should be removed from the URL after "authentication" because otherwise if I want to pass on the URL to a certain page to another user I end up copying the URL.
However, we need to be careful so that e.g. FlashMessages aren't lost.

Furthermore, user activiation should only be possible as long as a user is not activate (e.g. not in the validated group) - of course, that only works fine if validate and unvalidate group are different.

[zdavis]

Andreas,

Ok, we'll take a look at this or, if you can, feel free to send us a pull request.

Zach