ensure confirmation token before sending email