add a tokens table

Initially used to confirm email address changes
WiP user email changing and confirmation

Still needs to checks for changing existing user, updating alert emails
and actually sending the confirmation email, plus tidying up
email confirmation URL redirect