User login should be an email

[adam-buckley]

It guarantees uniqueness plus is more secure (harder to guess than a login of "test" or "adam")

We should also flatten the user/contact table

[adam-buckley]

So discussion with @careck showed that having a login instead of an email are good for business people who may type their credentials quite often.

Though it was agreed that the user/contact could be merged with the added configuration of deciding what field to use as the login credential.

Introducing two factor auth would also reduce the risk of someone getting into the system by just guessing the credentials.