Confirm a new email

Change a user's email to the new email that a confirm link was sent to. A user who updates their own email is sent that link at the new email, and its token lasts as long as a login link's. No credential is needed, so the link works from any device. Any later update to the user ends the link, this confirm included. The response holds a new session for the new email. An invalid or expired token is refused with 401 Unauthorized; a token for another user, or one sent before the user's latest update, with 403 Forbidden; and a new email that another user has taken since with 409 Conflict.