FIX: tighten up email token durations