Account deletion using the /v1/account/destroy API endpoint using account password without 2FA verification

Summary: The account deletion endpoint at `POST /v1/account/destroy` does not check for 2FA and doesn't require an authorization header. Therefore, an unauthenticated attacker who knows the password of a user can delete their account without the need of 2FA.

{"email":"<email>","authPW":"<authPW>"}