use email instead of federated identity for csrf protection