Eperez force authn 181

[EDUID-181](https://project.nordu.net/browse/EDUID-181): perform forceAuthn when changing password and terminating account
This code only has any effect after the user has re-authenticated. If a user spoofs the HTTP_REFERER to make it equal to the ACS, she might ask for a few more pages without invalidating the timestamp (so that she might start a password change, reauthenticate, and then navigate around before actually changing her password). In that case, the timestamp will be invalidated by the 10min timeout.

This functionality is meant to protect the user from leaving a reauthenticated session in a public computer... So I guess that a malicious user might spoof the HTTP_REFERER in a public computer so that the next user who starts a password change and doesn't finish it and leaves the place less than 10min after reauthenticating, leaves a reauthenticated session. So it is probably a hole, but a very small one, I would say.