password and email are now being logged. Still missing auth checks