Yeah good idea. I think it would be ideal to avoid forcing the user to sign out after an email change, though - would it make sense to return a new user token on success, so that the client can just replace their token instead of having to go through the sign-in flow again?