just use `email` instead of grabbing from the session again?