Email change invalidates JWT token

## Current behaviour
The email address change link can only be visited when logged in as the correct user. However, after successfully changing the email and confirming it, the user is visually still logged in (because the store contains all data of the previously visited pages), but their JWT token is invalid (because the email does not match the user anymore? not sure exactly why). So any subsequent API requests fail, until the user refreshes the page and gets back to the login screen.

## Expected behaviour
Either one of the following would be fine:
* Replace the JWT token with a new, valid one on email change (very convenient)
* Log the user out after changing their email, and ask them to log back in (easy to implement)
* We could auto-logout when visiting an email change link, and allow logged-out users to change an email. But we'd have to think about the security implications first, and for the user this workflow would be exactly the same as the one above, with more security risk involved.