remove find_user_by_email, start locking down password resets