referral email should use candidate token