email should use user id instead of straight email except for enquiries
front end should operate on authentication