Proposed fix for 736

Code to force users to sign back in if their password was changed from a different session per #736. I am about 80% sure everything is working here, I was able to test it from the admin change user perspective, but I actually couldn't get the profile page to change password to load.

Ideally I would have put this code in the `on_user_change_password` event, but I couldn't find any examples of event subscribers in the core for this kind of stuff. So it's implemented in a couple different spots now, but it looks like this class could use a good cleanup / refactoring at some point anyway and this gets it functional.