Make UIA grace period only apply to cross-signing requests

[richvdh]

Matrix.org's Synapse now applies a grace period to user-interactive-authenticated requests (the logic is that you do not need to confirm that you are the legitimate owner of an access token if you have literally just been given that access token).

However, various people have angrily reported that it is now too easy to deactivate your account by accident, since clients incorrectly assume that there will be a UIA step before the deactivation takes place.

As a workaround, it is suggested that the UIA grace period should only apply to E2E key uploads.

[turt2live]

Related: matrix-org/matrix-spec-proposals#3105

[ara4n]

Hi, me and my friend encountered an issue with element. Basically we lost our accounts due to a bug on elements frontend client. I have demonstrated this issue twice on the web client. My friend encountered this issue on the mobile application. https://youtu.be/Hq2LEBjHz48
Due to this bug it is now impossible to recover our accounts or get our names back

cc @callahad to get this prioritised