if a user authenticates using google with email X, but email X already exists on our side i think its password needs to be re-confirmed; claiming the existing account.
if email X doesnt exists we create it with a random password. In that case i think we need to assign a special ROLE_OAUTH or so which we can use to enforce either a password reset or always disable changing password (nobody knows the current pass, so it cannot be confirmed either way).
After #26 a few questions remain open:
ROLE_OAUTHor so which we can use to enforce either a password reset or always disable changing password (nobody knows the current pass, so it cannot be confirmed either way).