password restrictions
enforce unique email address