This endpoint should not look at whether a user is signed in since it takes as input an email that is not necessarily tied to the current session. Don't sign the users in.