#12 sending token via email