Yep, that ought to be secure!
Web site account activation system:
- Ask new user for name, email address, password
- Send confirmation email containing:
- carefully randomized confirmation URL
- name
- email address
- password (helpfully converted to lowercase for ease of use)
- Provide no method of changing email address or password
(site name omitted because no one has any reason to give them a credit
card anyway)