Sessions should be invalidated if password was changed

[Fasse]

If a user will change his password (e.g. in the profile or with the password forgotten function) we should invalidate all sessions and auto login of the user.

This is necessary so the user can be sure that the new password will used everywhere and a compromitted password could not be used in a saved session.