User can change their email
Upon successful login, the user can change its email address. Should we allow this? a number of SAML services match users based on the email address.
In any case, email address should be changed only upon successful verification of the new email address.