fix user_params if params[:user].nil?

Also only overwrite the user email address if it is actually set
in the session.