email + password (or legacy code)