Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

@mr_asg discovered an improper access control issue in TaxJar. This could have allowed for account takeover using the email change functionality. The vulnerability was caused by not correctly validating whether or not the reset password token was connected to the user being reset and was resolved by relying on the user fetched from the reset password token itself instead of the account ID provided in the URL.