Add a Handle for Users and limit access to email addresses

As a service, we should probably limit the use of email addresses to things like logging in and sending emails. For other things (users referencing other users, adding to or iterating over the list of users of an organization), we should use a `#handle` attribute for the User.