email is optional, will be secured (hashed), and used for password recovery only