Confirms the account by setting confirmed_at.

A user changeset for changing the email.

It requires the email to change otherwise an error is added.

A user changeset for changing the password.

Verifies the password.

If there is no user or the user doesn't have a password, we call Bcrypt.no_user_verify/0 to avoid timing attacks.

Validates the current password otherwise adds an error to the changeset.