need to handle password being null
username & email shouldn't be case sensitive