in the confirm action there is a redirect to an action outside of active rbac. There is no guarentee that this location
exists.

redirect_to '/'

Probably better to redirect to a "confirm success" message page