email is added as a session attribute