Allow the external authenticator to provide an email address.

This becomes the default address for the 'grant' notification field.
Eventually, this data should be put into the 'user' table anyway.