Update password securely, revokes other sessions on change
When user has no password (social login only), shows “Set Password” button
