Actually commit the session when changing password

Or else the password doesn't get updated.
Convert ensure_authorization to a decorator

This improves the code quality a little bit, by making it obvious that
a function requires authorization.

Along the way, fix a confusing error message about who already has the
account, it's the target, not the username.