When a user creates an account, they must activate their account by verifying the email. The token in that email is the default one, i.e. [user:one-time-login-url]
But when the user clicks on the link in their email, they get the 403 page (= You are not authorized to see this page).
Can anybody explain why this 403 page shows up?