The developer has no access to the session as it's encrypted on the client side. So I propose `{"error": email + " is not signed in"}` instead (or similar).