Your account and guest practice are separate. Passwords use server-side scrypt hashing. Email verification and password recovery are not configured.