If password not in new user email set default as 'hidden'
minor updates. Cookie correct UID on login if available.