Refactor Token code for simplification
Force all emails to lowercase #2493

This goes against RFC 5321, however in practice most system are
case-insensitive and it avoids human mistakes when entering login information