Bug - needed .downcase on user email for /login & /forgot