started but abandoned token/email based registration
added security filters