check email first to ensure we're logging in the most legit user out of a choice of 2