just found out that for Stanford shib, the email the idp returns to you is actually under the control of the user.  so this was an account hijack vuln.  Since the ids they return are not user-editable, and are of the from "username@stanford.edu", use this to link accounts instead.