spacing
confirmToken and refreshToken moved completely to tokenManager,

isDisabled is only checked on registration.