update template to display just email addresses
dont store the token in the cookie, use in-memory sessions instead