Registration handler and account console endpoint permits users to un-set their email address or bypass the "Verify email" realm setting

It appears that the system does not permit a user to not have an email address. If you attempt to self-service register an account with no email, it will return an error stating that the email is required. This behavior is also present in the account console.

However, if you tamper with the HTTP request to omit the email field entirely (e.g. delete the input tag for it via the browser's dev tools, or craft a special network request) it will accept the request and un-set the user's email. This works regardless of whether or not the email attribute is set to required or read-only in the Declarative User Profile feature. This does not work, however, if "email as username" is enabled.

Update: I am marking this as a security issue; I have just discovered it allows a user to bypass the "Verify email" realm setting.