Don't log the user out after changing account info

Also include
  * username validation -- no spaces or weird chars
  * no longer base64 encoded sha1-hex hash for CSRF token
  * refresh login page every two hours to keep session active
Merge pull request #684 from greezybacon/issue/unexpected-logout

Don't log the user out after changing account info

Reviewed-By: Peter Rotich <peter@osticket.com>