only accept either an email or an assertion