I think that it introduces a (minor) security risk : if you have access to an idle session, and you can force a user authenticate through another means, then you can exploit the idle session to change password.