[5.2] Refresh remember_token if reset password

[apollopy]

For security reasons, if the user to reset the password, refresh remember_token.

because:

In this case the user may have been hacking account

All the old password generated remember cookie should not be trusted

#13012

[apollopy]

In fact, I think, at this time, the old session should also be invalid

But to do so, the user database must add new field session_token, if change or reset passwords, change session_token

session recording user_id | session_token to validate, not only recording user_id

If the development team considered feasible, I will continue coding