#Vienna2017

alexpott → credited sugaroverflow → .

Given this is an allowed change but to a majorly important form I'm only going to make this to next minor branches and not to the patch. branches (10.3.x and 11.0.x)

Committed and pushed 0b78493d29a to 11.x and 27f7b679085 to 11.1.x and 4027f70a0ec to 10.5.x and deead9fdad7 to 10.4.x. Thanks!

I think this is probably fine.

There is a use-case for password reset links where people create a password, don't try to remember or it use a password manager for it, then use reset links each time. drush uli is a similar use-case during local development too.

However, because our password reset links also log you in, making the fields required won't break this - e.g. you can click the link, ignore the form, same as you previously did.

#58 asks a good question. Here's one answer. Because if they are not required and you use the 1 time login and then save the account without entering a new password it'll save and the resulting form will have the current password field. But you don't have a current password if you've come directly from an email sent due account registration so this is then an impossible task. So I think this change makes sense.