Instead of sending userId, userEmail, send sid, client_secret
This has the benefit of being possible from the _second_ riot instance, which may not actually have the email of the user registering. With these parameters, the RTS can get the email and user ID itself.
(see https://github.com/matrix-org/riot-team-server/pull/15)