supports users defined by email only (no username)