New users verify their email, then create a password. Returning users sign in with email and password.