Mission Impossible / How to create datatypes which cannot contain invalid state

In this program, the class AuthenticationProcedure implements the logic for the following passwordless login procedure:

1. The user goes to the login form
2. The user enters his email address
3. The user gets an email with a randomly generated token
4. The user enters the received token on the login form
5. The user is logged in

Refactor the example with your newly aqcuired knowledge.