Move "update email" to its own section of the profile page and require email confirmation

[chriscarrollsmith]

Obviously we don't want to let the user just change their email address from the profile page without additional security such as clicking an emailed confirmation link!