Making public_email = email a trait for a factory

This also fixes some specs that were relying on private email in
the user's `hook_attrs`

Changelog: security