Spec'd and implemented /user/email/confirm/:verificationId to refuse to change the email, when the accessing user isn't logged=in.
Spec'd and implemented the case when the verification ID is invalid.
Changed /new-password to have a more clearer name.
Changed /user/email/ to something more description.
Renamed /user/email/confirm to something more descriptive.
Spec'd and implemented /forgot.
Some refactoring.