add login via email/unhashed password; again, will remove in favor of oauth, so not bothering with security for now