Remove sudo mode and add password confirmation when changing email address

closes #674

src/Api/Controller/SetPermissionController.php

@@ -25,7 +25,7 @@ class SetPermissionController implements ControllerInterface
      */
     public function handle(ServerRequestInterface $request)
     {
-        $this->assertAdminAndSudo($request);
+        $this->assertAdmin($request->getAttribute('actor'));
 
         $body = $request->getParsedBody();
         $permission = array_get($body, 'permission');