Clear token after email activation

[steinkel]

activateUser() was setting token_expires to null but leaving the token value in the database. Old activation links remained usable if token_expires was ever reset. Now both fields are cleared on activation, consistent with how PasswordBehavior handles password reset tokens.

[Copilot]

Pull request overview

This PR fixes an email-activation security/logic gap by clearing the stored activation token when a user is activated (previously only token_expires was cleared). This prevents old activation links from becoming usable again if token_expires is later reset, and aligns behavior with the password reset token clearing approach.

Changes:

• Clear both token and token_expires during RegisterBehavior::activateUser().
• Extend the existing registration behavior test to assert the token itself is cleared after activation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Model/Behavior/RegisterBehavior.php	Clears both token fields during activation so old validation URLs can’t be reused.
tests/TestCase/Model/Behavior/RegisterBehaviorTest.php	Adds an assertion ensuring the activation token is nulled on activation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.