Why does this token need the real user email, instead of simply using the anonymous user id?