Old verification email links are not invalidated

[Jumpy-Squirrel]

Creating a new verification link does not invalidate the old one, making it possible to end up with an email address different from the one last entered into the form if verification links are clicked out of the order they were originally created in.

[Thiritin]

I will add a hash of the old email to the url and will check for this hash to be correct. Otherwise it will be rejected. I will also check uniqueness of the email on the controller.

Edit: won't do, too much complexity for little gain.