create profile upon email verification
list real staff, don't allow messaging for assistants