server: disallow email login, error handling