make sure user isn't tracked until logged in; require non-blank email/password to create account
better logging - include ip, user, and actual content length