Cleaned up SQL queries + other

- Changed SQL queries from using string concatenation to using sqlalchemy binds
  This should provide SQL injection protection.
- Don't allow users to use 'forgot my password' if they are already logged in.