email validation

Server-side validation is good for now...