EmailToken.active needs to check created_at too