Email/password change should not invalidate current session

[bajtos]

In #2693 and #3021, we implemented access-token invalidation when the users changes an email or a password. However, the current code deletes all access tokens, including the token used to make the change password/email request.

IMO, this is a poor user experience, the access token (session) used to make the change should be preserved.

One of the reasons why this was not made in the original pull requests, is that we don't have a good solution for getting the current access token. The easiest way forward is to wait for #3023 to land, after which we can use ctx.options.accessToken to exclude the current access token from the delete query.

[bajtos]

Done.