Shouldn't there still be an authorization for e-mail address?  Only b/c a user can log in with e-mail or user name?