Bug Description

I have a user who has several required actions.

• UPDATE_PASSWORD
• CONFIGURE_OTP

When the user update the password, he re-use the /login-actions/authenticate with its token.
But in the use-case, when the flow use token and not username/password he don't check the user required actions.

To Reproduce

No response

Expected Behavior

No response

Version

No response

Environment

• OS:
• Browser:
• Version: