redirect domain
don't validate password if guest
don't send new user email if guest
handle guest account
use utc time comparison