Introduce ExpiringToken, a base for future authentication
Don't use "dummy" anywhere
Validate email format