Ask for password before disabling 2FA

[x1nf1]

[julianlam]

Makes sense 👍

[x1nf1]

What about those forums using SSO such Google?

[julianlam]

Theoretically, it would be up to the SSO plugins themselves to expose a re-auth flow, but none do, so in this case, if there's no password set, I won't do the challenge at all.