Fixes #6614 : CMS allows password change without re-authentication.