remember to check user names cannot be someone else's email -- or otherwise there is a risk of impersonation