When a user makes a change to their MFA setup (eg adding or revoking tokens), we should send a notification email confirming the change (including information such as when, the type of factor, the action taken).

Todo: Finalise  the wording/format of the notification.