#18 Don't store email and pass in cookie