change SessionAuthentication to use user.email