complete login with user we're impersonating

[i-just]

Description

When a user without 2fa impersonates another user and needs to elevate their session via the password route, ensure that after authentication, we use the user that’s being impersonated to complete the login.

Steps to reproduce:

• clean 5.7.5 Pro installation
• create user A and activate their account (set a password)
• create user B and activate their account (set a password)
• login as user A, edit user B and use “Sign in as” to impersonate user B
• go to My Account > Password & Verification and click “Set up” for the “Authenticator App”
• when the elevated session modal pops up, provide the password for user A and submit the form
• close the “Authenticator App” slideout and reload the page
• notice that you’re now logged in as user A again

Tested that this issue did not occur if user A had 2fa set up or if they were elevating their session with a passkey.

Related issues

n/a