all the mess for /v1/change-email and token update