Authorization vulnerability using FastAuth

Using FastAuth, one could go from API authentication (which has limited scope, blocking changing password for example) to Session authentication (which can do everything).

Possible solution: Add a password confirmation or a secondary pasword (pin code ?) for FastAuth token validation.