Current password — required if the user already has a password set. Not required for OIDC-only users.
Verification email sent to new address
API metadata included in all responses