i allow newly created users who know their password and isn't confirmed yet to change their registration email (as long as it's not registered in my database)
the problem is that if they changed the email, i generate new email confirmation token, but the old token could still validate them(the one i issue on registration), which pretty much could mean that people could use their registration mail at first, change it to some other mail they don't have access to, and validate from the old one, which is a big security hole for me to just leave
is there any way to remove/revoke the old token? (technically i could create a new user and delete the old one, the old token wouldn't work on new user, yet i think there should be a better solution for this)