email is no longer unique, but citizen_number must be
Add password_digest field to Users