enforce email uniqueness

index the database based on email address, for case-insensitive uniqueness

chapter 6.2 page 254
add password validations

chapter 6.3.4 page 265