use "uid" instead of "email" for token auth validation