The Active Flag Trap: unvalidated-but-logged-in in CakeDC/Users

Why a CakeDC/Users account can be "not validated" and "logged in" at the same time — and how to build the flow the plugin leaves to you, using its own events.