Auth flow fixes

Email confirmation works reliably and the onboarding redirect loop is gone.