users can sign in with email address
refactors to not interact with session from controller and view