added token verification for email/pass tokens