yes, that's better.  This is only used for authenticating initial sign-ins and password resets, so it's not tons of lookups, but no reason not to use ids.