server-side: force logout if email is different