Fixes #14486: Secure session login is false security while changing password does not require old password

- Require current password to change it.
- Require re-auth (similar to admin page) when accessing account page so that email can't be changed without a recent login.