ChangePassword does not verify session

[adriendb]

The change password function in csrf.php does not actually check the username or if a valid session has been established. It always returns 'Password changed successfully.' I would also rename it to cswsh.php as it is Cross-Site WebSocket Hijacking.

[interference-security]

Working on a fix for this. Thanks for raising it. Since the whole application is vulnerable to CSWH, I will skip renaming csrf.php to cswsh.php. I will update this issue when the fix has been pushed to the repository.