Explanation above doesn't handle case where user needs to create account.
This can be handled by instant_registration=email. Code may need to change
to allow creation of new account without password. This case could be handled
by creating a long random password for the account. User can choose to set it
by password recovery or from user detail page.

Without a password, sensitive tasks that require re-authentication (e.g. for primary email
or password change) can't be done. So some thought needs to go into those flows if re-
authentication requirement is added.