public void Handle(CreatePasswordCommand command)
        {
            if (command == null)
            {
                throw new ArgumentNullException("command");
            }

            // get the confirmation
            var confirmation = _entities.Get <EmailConfirmation>()
                               .EagerLoad(_entities, new Expression <Func <EmailConfirmation, object> >[]
            {
                c => c.EmailAddress.Person.User.EduPersonScopedAffiliations,
                c => c.EmailAddress.Person.User.SubjectNameIdentifiers,
            })
                               .ByToken(command.Token);

            // set up user accounts
            var person = confirmation.EmailAddress.Person;

            person.User                     = person.User ?? new User();
            person.User.Name                = person.User.Name ?? confirmation.EmailAddress.Value;
            person.User.IsRegistered        = true;
            person.User.EduPersonTargetedId = null;
            person.User.EduPersonScopedAffiliations.Clear();
            person.User.SubjectNameIdentifiers.Clear();

            confirmation.RetiredOnUtc = DateTime.UtcNow;
            confirmation.SecretCode   = null;
            confirmation.Ticket       = null;
            _entities.Update(confirmation);

            _passwords.Create(confirmation.EmailAddress.Person.User.Name, command.Password);
        }