Don't change user password in GET request handler

Changing the password after authenticating against CouchDB caused
the `AuthSession` cookie to immediately become invalid and therefore
useless.

With this change, we keep the desired property of a token being usable
for authentication only once, however only with regard to the
couch_email_auth endpoint.  A token can now be used as password for
direct authenticating against CouchDB's `/_session` endpoint, which
means that we can't guarantee anymore that tokens can only be used for
authentication *once*.  A possible solution to that problem would be to
not have an equality relation between token and password, but to rather
derive the password from a combination of the token and a secret value
which is stored e.g. in the user document.