login: hide password in entry box
login: move alert message to session view

The problem was that putting this in the application view resulted in
the application showing a message twice upon a User edit, because
`flash` would get populated, and also the user controller added a `notice`
as well (with the string "User was successfully updated.").
users: make edits: check for logged in user

Users can only edit their own properties.