The current account management behavior should be updated so that:

1. only existing users can create new accounts (and only create them within their own institution)
2. accounts can be imported (there's a file with all the users, credentials, and affiliations)