adding lower case emails if the assertion isn't a hashed email. fixes #469