Should we look users up by email address or by OpenID?