Fix token link in request declined email

- ensure that the email recipient is the person
who gets logged in from the token url