Load user from db when changing passwords.

It was possible to get the request.session.user['passwords'] out
of sync with what was actually in the userdb (and perhaps more
importantly, in the credential_store). This resulted in the inability
to change passwords in the dashboard.
Minor code cleanup.
Require much longer code than 48 bits when resetting passwords.
Code cleanup.