We handle it implicitly because `_user` is marked as required in the `validation` block above. If `_user` is not provided, `node-restify-validation` should catch it. If `_user` is provided and fails SSA verification, this plugin should catch it. If it passes both those steps, then `_email` should be a valid, non-null email.