fixes #91 User should be logged out when LDAP password changes

This adds the functionality where, if the user's LDAP password has
changed since the last time they authenticated they will be prompted for
their email / password again.

This is done by storing the time of their last password change in the
secure sesssion cookie. If it does not match what is currently in LDAP
then a 401 is returned forcing the user to reauthenticate.
#91 old session destroyed on password change
added bigint lockdown dependency back in
update useragent to 2.0.7 to detect IE11
changed pwdChangeTime to pwdChangedTime
Merge branch '91-use-pwdChangedTime'