make sure the tokenAuth is not send in the email