4.0 email activation pilot error?

[Peter Evans <pe...@ixp.jp>]

System:
solaris 10 intel, glassfish v2ur1 b09d
roller 4.0
database - derby

all running as a regular user.
--------- roller-custom.properties -----------
# derby?
#
installation.type=auto
database.configurationType=jndi
database.jndi.name=jdbc/rollerdb
mail.configurationType=properties
mail.hostname=localhost
--------- roller-custom.properties -----------

system.log shows:
----------------------------------------------
[#|2008-02-28T16:53:49.729+0900|INFO|sun-appserver9.1|javax.enterprise.system.stream.out|_ThreadID=14;_ThreadN
ame=httpWorkerThread-4848-1;|
Roller Weblogger: Successfully loaded custom properties file from classpath|#]
----------------------------------------------

actions:

launch, create "admin" user,
global config - "require new users to activate accounts via email" ON
email address <something at my site>
save
new window in another browser.
http://SITENAME/roller/roller-ui/register.rol
try and create a user ...
it sends email ... mail is received, its a mess of html without a nice text equivalent for 
us stone age text people ...

visit URL:
http://SITENAME/roller/roller-ui/register!activate.rol?activationCode=3319ba5e-a156-425f-b828-4051f68b2123

big red error box basically saying "every field is a required field" along with a default locale "albanian"


there are any number of warnings about roller, but nothing about the above failing to find its user.
Though a few installs ago, it was CustomUser blah unsupported twaddle. Only the space goat knows what I
did that time.

--------------------------------------------------
from the system.log

[#|2008-02-28T17:01:50.228+0900|WARNING|sun-appserver9.1|org.apache.coyote.tomcat5.CoyoteRequest|_ThreadID=18;
_ThreadName=httpSSLWorkerThread-8080-1;_RequestID=d780d777-7014-48d9-9456-466718e1f8dd;|PWC4011: Unable to set
 request character encoding to UTF-8 from context /roller, because request parameters have already been read,
or ServletRequest.getReader() has already been called|#]

^^-- one per page hit.  You have precious little chance of finding anything in this noise ...

access.log

"192.168.220.104" "NULL-AUTH-USER" "28/Feb/2008:17:07:51 +0900" "GET /roller/roller-ui/register!activate.rol?a
ctivationCode=3319ba5e-a156-425f-b828-4051f68b2123 HTTP/1.1" 200 51107

Thats's our URL, magic code is the same.
--------------------------------------------------
does derby know about our user?

usagi 138> bin/ij
ij> connect 'jdbc:derby://localhost:1527/rollerdb';
ij> select activationcode,isenabled,username from rolleruser;
ACTIVATIONCODE                                  |ISENA&|USERNAME                                              3319ba5e-a156-425f-b828-4051f68b2123            |0     |bunny2                                                

yes, derby knows, same code.

what happens if I put a bogus authentication code in?
exactly the same, no complaint that the authentcation code is inane/insane etc.

(rinse and repeat with "enable debug mode" ON in sitewideconfig, nothing at all)


--------------------------------------------------------------------------------------

	Where should I look?
	What should I look for and why can't one delete users in the server administrator?