Delete all sessions for a user when password is changed

[tobias]

This will invalidate any other active sessions, so would kick out an attacker if they got in via your old password.