don't include email in the list of valid logins as this isn't unique