Invalidate session cookie if password changes

Currently an entity remains accessible via a session even when the password changes. A user would expect the session access to be invalidated at that point. Otherwise this poses a security risk.