Fixed a bug where the wrong user object was sent in the signal

The user on the request object is an anonymous user most of the time which is not that useful to the listener of the signal (imagine you want to send the user an email confirming the change of the password). So it might be better to send the user we fetched from the url params.