spun off from #8516

The contributions_url field should be writable via the API. It'll need some special validation that only valid contribution domains are allowed.