associate oauth logins with existing users, create new if needed

Users are uniquely identified by their email-address. A user can login
with any oauth service - when it returns the same email, its the same
user.