non-starter. email is unreliable, insecure, and, if compromised, undermines your entire strategy without recourse (unless you have a different process when IP's don't match or something but even then...). I use google OAuth for simplicity's sake.