* added security condition to check that one logged-in user cannot activate another one user via email activation link;

* fixed double handler of email activation link (wp_die doesn't stop the script for some reason);
* added redirects to login page with error notices instead of wp_die text;

includes/core/class-user.php

@@ -1362,7 +1362,7 @@ if ( ! class_exists( 'um\core\User' ) ) {
 		<?php UM()->user()->auto_login( 10, true ); ?>
 		 *
 		 */
-		function auto_login( $user_id, $rememberme = 0 ) {
+		public function auto_login( $user_id, $rememberme = 0 ) {
 
 			wp_set_current_user( $user_id );