isn't this insecure? after OAuth authentication my email could be anyone