Fixed the password reset function

- noop propage_user_changes now properly update the user in am db
- small refactoring and removing of duplicated suggested password function
- upon password reset _ALL_ previous credentials are revoked, we might change
  this in the future when adding 2FA
Moved debug log for csrf token validation