Getting the $user object of a logged out user based on a username and setting its status
What is wrong in your code is that the implementation of hook_menu() is gathering the arguments for the callback, when that hook is only called in specific moments (as I reported in my previous answer).

Rather than doing as you do, I would rather use the following code:

function mymodule_menu() {
  $items['auth/%user'] = array(
    'page callback' =&gt; 'mymodule_page',
    'page arguments' =&gt; array(1),
    'access callback' =&gt; TRUE,
    'type' =&gt; MENU_CALLBACK,
  );
  return $items;
}

function mymodule_page($account) {
  user_save($account, array('status' =&gt; 1));
  drupal_goto('&lt;front&gt;');   
}


In this way, Drupal will automatically get the user ID, and pass to the page callback the user object for that user. drupal_goto() is necessary as the page callback is not showing any output; you can redirect the user to any pages you want. (I chose "&lt;front&gt;" because it's a path that is always defined, in Drupal).
If you need to use a username, then you need to use a loader function that loads a user object knowing the username. As in Drupal there cannot be two users with the same username, it should avoid the user being acted upon is not the desired one.

function mymodule_menu() {
  $items['auth/%mymodule_username'] = array(
    'page callback' =&gt; 'mymodule_page',
    'page arguments' =&gt; array(1),
    'access callback' =&gt; TRUE,
    'type' =&gt; MENU_CALLBACK,
  );
  return $items;
}

function mymodule_page($account) {
  user_save($account, array('status' =&gt; 1));
  drupal_goto('&lt;front&gt;');   
}

function mymodule_username_load($name) {
  return user_load(array('name' =&gt; $name));
}


The code defines a new wildcard argument; if "%wildcard" is the name of the wildcard, then Drupal will look for the wildcard() function that needs to return FALSE in case of error; in that case, Drupal will return the "page not found" error (404).

Important I used the same value you used for "access callback," but it is not something that should be done, in this very specific case.
The reason is that the menu callback alters a user account; imagine what should happen if a user with a blocked account could do if he knows of this URL: He could enable his own account very easily. This is because the entry "access callback" you are using is saying "everybody can access this menu callback," which also means that Google, or any other search engine could enable a user just visiting the URL the search engine has found in some way.
In general, the rule is to restrict the access to a menu callback that alter some data, which includes also the case the menu callback deletes data.