Fix 616

touch #616 

This isn't a fix to the issue, though it does make the 'not authorised' error be more descriptive if the transfer fails because of mis-matching tokens or emails.

It also resolves a small issue where a user could change the target address to their own (if they had snooped an email perhaps)