Removed the index again, bad idea, better to search only for the email address and compare the password in the application (one could use an async query and compute the password hash while querying the database and when the result is available from both compare them; although this speeds up the login process which might not be what we want = slow down the brute force attackers).