When a user tries to change their email, redirect them to the confirm password page (like Github's sudo mode) instead of having them re-enter their password on the change email page. This is the same thing we do when a user updates their API keys. This way we have can use the same confirm password authentication flow for everything that needs a password.