ConfirmEmailAddresses configuration doesn't behave as expected

[scottbommarito]

We have a configuration named ConfirmEmailAddresses that is intended to control whether or not email addresses must be confirmed.

It seems, however, after looking through the code, that this configuration only controls whether or not a person registering an account must confirm their email. Changing your email still requires confirmation regardless of what the configuration is set to. Ideally, this configuration should prevent changed email addresses from being confirmed as well.