Use password to disable 2FA instead of a token

Using token doesn't make much sense when you can generate new tokens
right below.

closes #8006