Email change must be confirmed

[nuest]

The email change should only be completed when the user has clicked on the link in the confirmation email. The confirmation could be a two-step process: first show you control the old email, then you show that you control the new email.

Also, the email change should fail if an account for the new email already exists!

We could possibly save the information in the cache and see if the object returned from cache as a email_change option and then handle it from there.