Do not automatically login after password reset, as it would circumvent two-factor auth (if enabled) Do not require e-mail address changes to be re-confirmed, it's only trouble for no real benefit
