Change Details

`disableOATHAuthForUser.php` should call `SessionManager::invalidateSessionsForUser`. If the user is locked out, there is no harm in it, and in the case of an attacker achieving 2FA reset via social engineering, this ensures that the legitimate account owner will notice (whereas they might miss an email = have no email address).

`disableOATHAuthForUser.php` should call `SessionManager::invalidateSessionsForUser`. If the user is locked out, there is no harm in it, and in the case of an attacker achieving 2FA reset via social engineering, this ensures that the legitimate account owner will notice (whereas they might miss an email / have no email address).

`disableOATHAuthForUser.php` should call `SessionManager::invalidateSessionsForUser`. If the user is locked out, there is no harm in it, and in the case of an attacker achieving 2FA reset via social engineering, this ensures that the legitimate account owner will notice (whereas they might miss an email =/ have no email address).