Don't serve the user list to anonymous users.
Don't show the domain of email addresses.