for convenience, don't delete old auth-keys
make sure all emails are treated as lowercase