this has been keeping me awake a little (i think it's a mistake i've already made). 
this exposes user email addresses, which we have moved against in other areas of the app.