email verification via token links - fixes #3