[#7799] invalidate all other sessions when changing your password

logout() uses invalidate() so that a new session is created, and a force-logged-out
session isn't stuck forever unable to log in again

minor other cleanup of unneeded beaker.session things.