Password reset access control

Summary

A security researcher discovered that during password reset, the user was automatically logged in if the password reset was identical to their original password; this was the result of a change to prevent password resets to the identical password. However, if the intent is to reset the password, as shown by the user being on the password reset screen after clicking on a password reset email, the user should only be able to reset, rather than simply log in.