* whenever somebody other than the record owner publishes an edit for a
  record, the owner gets a notification with a summary of the changes
* if the owner publishes the edit themselves, then no such mail will be
  sent out - same for the system identity
* shared links with "edit" permissions still require a login to access
  the deposit form anyway, so edits are always backed by users