allow update of lockedByIntruder flag for use by admin tools
add comment about different behavior for lockedByIntruder
remove unnecessary new account settings

the emailVerified flag will be set automatically when setting the email on the User object, we shouldn't override it
forceChangePassword can be set when setting a password
automatic guid generation for a new account should happen in setNewUserDefaults
[#31] actually validate email addresses
don't accept email addresses containing whitespace
minor fix for error message
consolidate invalid email tests
pass attributes being updated to validateUpdateUser to allow validation to be performed on what is being updated