If I'm reading all this right, this is a potential security issue. Hear me out.

With the way this is written I can provide the function any string as a token, and any email I want. This will cause the api key check to be skipped since there's a token, but `get_user_data` will get both the fake token and the real email. Then `look_for_user` will use the email if it gets both. So I think I could get user data by passing in a fake token and a real email address and avoid the api key requirement.

Switching this to:

``python
if email and not APIUser.is_valid(api_key):
    ...
```
... should do it. But I might also (just for safety) preference token more by not sending the email to `get_user_data` if a token is provided at all.

```python
kwargs = {}
if email:
    kwargs['token'] = token
elif email:
    kwargs['email'] = email

user_data = get_user_data(**kwargs)
```