finish off the find-password-token-by-email-address stuff