permit the first user account to be a domain control validation address because a) it will necessarily be an admin and b) the user doesn't know the rules yet