As a user I want to change password

[peterpolman]

Password change

• always ask for password to change when login via one-time login link
• only after private key ownership is transferred
• update user password with email confirmation