allow clients to use an email address instead of an assertion for updating or deleting tokens; use sync kvstore api