- more tests
- make session_id optional, if not set take Login-Server Cookie
- check only for password_old if user was logged in with password, else reset password from email wouldn't work
- make successfull change password also add 1 to valid_values
- don't update other fields in db if only update password was called