More secure email change

[pgrenaud]

Currently, a user can change the email address without any verification on our side. As per standard internet way of doing things, we need to enforce 2 verifications:

1. When a user attempt to change his email, we need to ask for his current password, the same way we ask for the current password when changing password. That will protect the user from someone changing his email address if he left his session open unattended.
2. When a user successfully submitted a new email address, we need to send a verification link to the new email address. Until the new address is validated, we still continue to use the old one.

[jdupl]

Vérifier à nouveau le courriel demande de changer pas mal de code.