Currently, when a user's password changes between signing in with their
password and providing the 2FA code/U2F GitLab successfully allows the
user to sign-in. GitLab should invalidate the sign-in process when
this happens. This change invalidates the sign-in process when the
user updated_at attribute changes between the two phases of sign-in.