See other comments regarding employer being able to create an account via POST request. I'd assume that's the only way to create clean separation, even then I don't doubt they'll be able to fill in that gap!