Before actually doing this you need to check that the token has an email and that the `email_verified` field is `true` (and exists).