issue #20445: revalidate session on password reset
issue #20445: actually reset the password