This adds a new password field to the two-factor authentication settings page.
The current password will be required to:

* Set-up 2FA
* Disable 2FA
* Generate new recovery codes

Changelog: security