    public function password()
    {
        $user = Auth::user();

        return view('account/change-password', compact('user'));
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.