Refresh the login cookie when it's used to login
Ask for old password when changing password

Also update login cookie when changing password.

Both changes don't affect admins changing someone else's password.

Last, but not least: removed a debug message when creating an account.