change user/download email to token