User can no longer modify his profile to set an email address
Store token, auth creation date and last auth usage.
Enforce uniqueness in db