Added request for user's email, redirect to login if email permission missing
Removed user email permission.  Send 403 for unauthorized users trying to login to /admin