add option to block access and option to use email instead of username; refactoring throughout