Change password logic inversion

Summary

A security researcher discovered that during the password change process, the new password was validated before verifying the old password's accuracy, despite the user entering the values and submitting on a single form. If a user was logged in on a shared machine, this could have led to a productive (albeit, limited scope) password enumeration attack during the remainder of the session (up to 7 days) for that one user.