email change now asks for password (to prevent account takeovers)