user created with random email to prevent rewriting by login