I am having the exact same problem. I am running version 2.8.6 with a PostgreSQL database. Where do I check for "the entry for confirm:<uuid>"? Edit: Maybe my issue is slightly different: I checked the new user's account. The email address is actually marked as validated, even after the 404 response. Thanks!

Re: content security policy Is CSP supported in 1.17.1?