Enforcing identity format '...@developer.gserviceaccount.com' correctly

Should **not** be merged until after #9.

This will have to be merged and rebased after #9 is done, but I'm pretty sure the validation that is currently _broken_ was actually intended.