Facilitate using all mail addresses for authentication.

Use user['_id'] instead of user['mail'].

Also, change order of events when changing passwords from

  add -> check old -> revoke

to

  check old -> add -> revoke

... in order to reduce chances of the final revoke action
failing.
Less debug logging of user data.
Merge branch 'master' of github.com:SUNET/eduid-dashboard