A request for an e-mail change token should be done on the page /user/change_email/request. The user needs to send a password (to confirm the e-mail change) and a new e-mail.
A confirmation of the e-mail change should come in on the page /user/change_email/confirm?token=...
The token should be sent to the API.
A request for an e-mail change token should be done on the page /user/change_email/request. The user needs to send a password (to confirm the e-mail change) and a new e-mail.
A confirmation of the e-mail change should come in on the page /user/change_email/confirm?token=... The token should be sent to the API.