email address not validated when the user changes it
When a user updates his email address, django does not send a confirmation email to ensure that the user effectively controls this address.
This allows any user to forge a inria/irisa address to create a webapp.