It is easy to mix up `find_by_activation_token` and `load_from_activation_token`

[joshbuker]

While writing tests for v1, I accidentally used find_by instead of load_from, which had me scratching my head as to why the test was finding the record even when set to nil. This is an easy mistake to make, and a potential security vulnerability - need to find some way to refactor this that makes it difficult or impossible to mistake.