Fix wrong redirect after forced pass change

A new user (`first_login: true`) who is forced to change his password
(`forced_password_change: true`) was redirected to the change_password
page (instead of my_page) when he didn't get the login credentials right
on the first attempt.

The `back_url_hidden_field_tag` was added to the password form to
persist the original referer (in the case that the first password change
attempt does not succeed).
This makes the redirect work exactly as if the password change succeeded
on the first try.