UX: Changing Primary Email from Account Settings

[stepmr]

Settings: ACCOUNT_EMAIL_UNIQUE = True ACCOUNT_EMAIL_CONFIRMATION_REQUIRED = True

Usecase: If a user changes their email in account settings, they receive a "Account settings updated." success message. The email is changed and the confirmation sent. However, the new email is saved even if it has not been confirmed.

Issues:

1. If a user has changed their email to an incorrect one, logged out AND forgotten their password :) They have no way of reseting their password.
2. If a project is using email authentication, a user could change their email to an incorrect one and have no way of accessing their account.

Potential UX Fixes:

1. Instead of a success message, the user could receive the something similar to the "email_confirmation_sent" message. Like "To save these changes, please confirm your new email address. A confirmation email has been sent to {email}".
2. Instead of applying the changed email right away, wait for it to be confirmed. If a user logs out without confirming, the previous verified email should still be the one associated with the account. Maybe present the user with a message like “Last time you were here, we were unable to confirm your change in email address.” (this could be better, listing the both emails, the date, and allowing them to resend the confirmation).

[msander]

An easier way would be to let the user enter the email twice, and log him out afterwards. But I think your suggestion is nicer.

[k4ml]

I made initial commit to play around with fixing this. If the changes look fine, I'll clean it up and submit a PR.

[brosner]

@k4ml thanks for the contribution! I will take a look at your changes more in-depth in the next couple of days during DjangoCon.