Expire pending user changes after 15 minutes

Expire pending user changes after 15 minutes

15 minutes should be plenty of time for the user to complete the MF
authentication flow. A user is not going to sit patiently for 15 minutes
without simply closing the browser window which de facto forces them to start
anew, because nothing leads back to the MF authentication flow except
performing yet another login.

Email codes are the only (default) method that could be slow without the user
being able to do anything about it (e.g. due to greylisting). These codes
already expire after 10 minutes, giving an implicit upper bound (when ignoring
the fact that a new code will be sent every 2 minutes during refreshing).