email without pw = ok when cross sign_up