Admin Security (2FA / Roles)

[tbba]

The brand new 2FA login can be bypassed using this, I found out.
Also I would like the idea an option to exclude roles from the frontend login (like forgot password)

[tbba]

also

• Change password security: ask for the old password before allowing setting a new one