E-mail confirmation token shouldn't expire

[DavidMStraub]

Currently, the e-mail confirmation token expires after one hour. That doesn't make much sense because often those e-mails land in the junk folder. If the new user doesn't manage to click the link within one hour, their account is blocked until the admin manually confirms it, because they can't confirm anymore.

Alternatively, we need an endpoint to trigger a new confirmation e-mail. But I don't see a security risk in simply not expiring the token.

[DavidMStraub]

Fixed by #450.