email vs nick handling, consistent use of verify_password, oldsha compatibility