Issue 3689 edit email field

@6a68 - When ripping out requiredEmail, I made some assumptions in the authenticate module that were incorrect. I assumed that if the email was specified when the module started, it meant that the email address was immutable. This is not the case. A new user who enters an email address, goes to the set password screen, and then cancels and goes back to the authenticate screen should still be able to edit the email address.

Users who must authenticate post-email-verification, on assertion->password credential upgrade, or on transition_to_secondary must enter the password, but in this case the email is immutable.

So, I pass in whether the email is mutable or not from the state machine.

An ephemeral instance (with the fix contained in #3702) has already been pushed to run selenium tests against.

fixes #3689