Currently, if a user sets a secret question, the secret answer is not enforced to be required. Also if the question is cleared, the answer isn't cleared, this is not correct.
The correct behavior should be that when the user sets the question, the answer should be required and if it is cleared, the answer should get cleared.
It is good to write unit tests to prove that these conditions are not currently met and go ahead to fix them.
See UserFormController and ChangePassworFormController