Add a Handle for Users and limit access to email addresses

[jgnagy]

As a service, we should probably limit the use of email addresses to things like logging in and sending emails. For other things (users referencing other users, adding to or iterating over the list of users of an organization), we should use a #handle attribute for the User.