in the schema here then shouldn't

confirmToken

be updated to be

@isUnique

? https://github.com/graphcool-examples/functions/blob/master/authentication/email-user-management/email-user-management.graphql