We should take a call on whether `User.del_email` should prevent the deletion of a primary email address. For one, this will potentially block a User account from being deleted at all because the cascade will fail (though this can be addressed).