Refactor account activation and password reset

The account activation and reset mail now only contain the code. String placeholders are numbered correctly again. The activation and reset keys' length has been reduced to 8 characters.

Activation and login failure handling has been moved to the service layer. Account activation is now using the ban logic as used for login failure logic.

Fixes #47 (closed).