Allow changing email

Currently, email is an immutable field. People change emails, so this has to be able to change before this can be used for real. We should also require email verification before associating emails with users (related to #16)