Delete all user's sessions when it changes its password (closes #3836)