Bug fix: Invalidate session on password reset