validate email address format when creating/updating accounts

This could more specifically throw `InvalidEmailUserException`. And then, upstream, `updateUser(...)` could throw both that exception as well as `UserNotFoundException`, instead of the more general `UserException`. Unless, that is, if you prefer the more general exception. I'm not sure what is good practice when throwing a general exception if in fact not all the extensions of that class may in fact be thrown (since `UserAlreadyExistsException` would not be thrown from `updateUser(...)`).