small update to recommendation

Addressed feedback from Norsey

submissions/description/broken_authentication_and_session_management/failure_to_invalidate_session/on_email_change/recommendations.md

@@ -1,6 +1,6 @@
 # Recommendation(s)
 
-The application should invalidate all current user sessions, both server-side and client-side, when a user changes their email.
+The application should invalidate all current user sessions, both server-side and client-side, when a user changes their email address.
 
 It is also best practice to shorten session timeout values based upon business needs. The length of the session should take into consideration the criticality of the application and the data contained within.