Hi Aaron,

Thank you again for this change! I had forgotten to update the bug tracker to 
indicate it's closed, but it is, so I'm marking it resolved here!

I have submitted a fix here: https://github.com/openhatch/oh-mainline/pull/99

What about immediately expiring the session after changing the password? (this
has the side effect of logging out the current user)

Thanks for this bug submission. I think that change makes sense.

I had to reset my password because I forgot it, but when I got back to my other
computer with a "remember my session" option enabled, the session was still
active! If someone is resetting the password for security reasons, it should
really kick any other existing sessions out, leaving access only for the person
with control of the email account.

Admittedly, it might be possible for an attacker to change the email account,
but fixing this would be a good step.