extraLoginCriteria so that email addresses on other objects don't block users