I have a very weird user flow question. I have an account creation system that when a user signs up, they are sent to their home page but they have no access to the main functionality of the site until they verify their email. However, my email changing system requires an email to be sent to the current one and then another one to the new email to verify it. So how can I do this properly without any security vulnerabilities?