adding lockout_email to request and response to allow overriding of username