Fixed a but causing system messages to only show up if displayed before
the call to get_embedded_profile_form().

Corrected an unset variable in embedded_profile_form_update() that might
have caused passwords to be set incorrectly.

Removed session_destroy() on logout because system messages could not be
displayed when a password was set. Wordpress logs a user out when changing
a password, so the message was getting destroyed. Extra care now needs to
be taken to remove any session variables individually when they are no
longer needed, because the $_SESSION array will persist accross logins.