where are we handling the case of a missing email? we should not even hit redis if we know we don't have an auth token