When an email code has already been used, just redirect to signin.

data/model.py

@@ -327,8 +327,11 @@ def create_confirm_email_code(user):
 
 
 def confirm_user_email(code):
+  try:
     code = EmailConfirmation.get(EmailConfirmation.code == code,
                                  EmailConfirmation.email_confirm == True)
+  except EmailConfirmation.DoesNotExist:
+    raise DataModelException('Invalid email confirmation code.')
 
   user = code.user
   user.verified = True

endpoints/web.py

@@ -226,7 +226,11 @@ def github_oauth_callback():
 @app.route('/confirm', methods=['GET'])
 def confirm_email():
   code = request.values['code']
+
+  try:
     user = model.confirm_user_email(code)
+  except model.DataModelException as ex:
+    return redirect(url_for('signin'))
 
   common_login(user)