Confirm email address changes

Changing your email address now sends a confirmation link to the new address, and the change only takes effect once you click it. Links expire after an hour and requests are rate limited.

Once confirmed, the old address gets a security notice and all other sessions are signed out. No password is needed, so this works for users who signed up with OAuth too.