draft of token return functions
trying to get email change to work
avoid timing attacks in password reset