Self service email change

Changing an email can currently only be done by an admin. This adds self-service email change.

The behaviour is the same as when changed by an admin.

The tests might be hard to compare because I've refactored them, but they should be readable commit-to-commit.