in case of email change: verify old address first with GUID in email? then, also verify new address with GUID in email?