alphagov/signonotron2 — pull request #32 by jamiecobbett (2012-11-16 12:03:03+00:00)
Title: Require email-based confirmation for email change

Only applies to email changes by a signon admin. Self-service changes coming soon.

Until now, email changes have been instantly applied. Any mistakes would probably be missed until discovered (or not) by the user.

There are two things that I think are worth pointing out as not ideal:
* I had to use an unreleased version of Devise to get the expiry on email confirmation tokens
* the "Cancel email change" feature relies on JS