Token should contain user email for the sake of uniqueness