Post Email Confirm

The new inbox's link: ok with the address changed and confirmed, taken when another account has claimed it since it was asked for, expired after a day, invalid for anything else — a used link included, as the token was signed under the address it replaces.

No session needed: the link may well be opened on another device, and its token is the authentication, as every mail link's is. The address the account had hears of the change (compose_changed) when it was a confirmed one: an unconfirmed address may be a stranger's.