Yeah, I realize it was just a continued session, but that's exactly what I mean. For things like password changes or privilege changes, there should always be a mandatory re-auth to make sure it's not someone else at keys.

This is pretty much just best practice. When's the last time you could change your password without entering the original, short of a re-verification via email? Same idea here.