Update password in account page

[afcruzs]

This PR adds a section in the account page to update the password, I added a straightforward endpoint which confirms the current user old password and the new password (twice), and then proceeds to update the database. This is useful to revoke passwords from arxiv-sanity that might have been leaked from other websites. There are a couple of other changes that I needed to do to run the server:

1. Changed from werkzeug to werkzeug.security. I suspect the latest version of werkzeug refactored the security stuff into that submodule (requirements.txt installs the latest version).
2. import sys was missing from thumb_pdf.py, it is referenced on line 16.