sid is retrieved from request body

mobile number is used if user cannot be found with email