additional safeguards

server/djrandom/frontend/user_views.py

@@ -119,7 +119,7 @@ def user_send_invite():
 def user_activate(token):
     email = request.args.get('email')
     user = User.query.filter_by(activation_token=token).first()
-    if not user or user.email != email:
+    if not user or user.active or user.email != email:
         abort(404)
     session['userid'] = user.id
     user.active = True