send back user_id not email, clients will use the id to lookup the user