Redirect to root_path after password update

This makes it impossible to go around two-factor when resetting a password.