new session when user updates identity

When a user updates their own username/email, we need to give them a new session as the current one could be invalidated after the update.