would it be better to hang it on the request object (i.e., `req._email`)?