There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a user to log in, and then change the password on a separate page that doesn't require the old password?
I'm asking because I'm trying to streamline a mobile application, and am considering making the standard web application have the same workflow.
Example of an "annoying" workflow for the user:
User is notified PW is expired or must be changed (immediately)
User is directed to the screen below. The additional prompting for "current password" is annoying and I wonder what benefit it provides...