feat: move password change to REST and add session rotation

### Additions

* added REST POST `/auth/password/` endpoint for password change (FE needs to save the rotated sessionid from the response)
  * requires json body: {"old_password": "string", "new_password": "string"}
  * returns: {"status": "string", "detail": "string", "sessionid": "string"/null}

### Changes

* all REST `/auth/*` endpoints now return the `sessionid` extended by a typical _JsonResponse_ used in all endpoints: {"status": "string", "detail": "string", "sessionid": "string"/null}, the behavior was not changed

### Deletions

* removed mutation `passwordChange`

Closes #436