send token link in email. closes #25