Missing access control at password change

Summary

A security researcher discovered that after resetting a password, the user was automatically logged in. As such, compromising a legitimate password reset link (via referrer token leakage or a similar issue) could lead to compromising the account since the user would not be forced to log in after resetting their password. OWASP forgot password recommendations suggest a better approach, which we have now implemented. Thanks to @attacker911 for another great report!