Just a minor here to make tyk even better (from my perspective).
The login is currently based on the E-mail address (which is fine by me) and when several of my colleagues were logging in I got the response of failed logins.
I entered their mail addresses in CamelCase.
Most of the applications I know do a (tolowercase()) within the check function.
Future users would appreciate it if you'd apply that best-practise.