always respond with 302 redirect to prevent email enumeration attack