reduce token validation code compelexity
only require email for email users. fixes #9. fixes #10.