don't lock email when key is present, since a new request may not have an email and still require it to submit!!