Permit use confirmation token only when user create a new account or change the email

app/controllers/users/confirmations_controller.rb

@@ -49,11 +49,11 @@ class Users::ConfirmationsController < Devise::ConfirmationsController
     elsif resource.errors.empty?
       set_official_position if resource.has_official_email?
 
-      if resource.confirmed_at
-        message = :already_confirmed
-      else
+      if !resource.confirmed_at || resource.unconfirmed_email
         resource.confirm # Last change: confirm happens here for people with passwords instead of af the top of the show action
         message = :confirmed
+      else
+        message = :already_confirmed
       end
 
       set_flash_message(:notice, message) if is_flashing_format?