Prevent external-IDP account pre-hijack and require authentication for WebAuthn/TOTP enrollment

Fixed a security vulnerability in Login V1 where external identity provider accounts could be pre-hijacked, and now requires authentication before enrolling WebAuthn, U2F, TOTP, or OTP methods.

Source: original entry ↗