auth: Fix password_changed function, fixes #4043.

Never repot a changed password for default or anonymous users.

If anonymous access is disabled we don't get the default user here so we
also have to check if it is the anonymous user. In both cases (default user
and anonymous user) we can skip the password change check and return False.

rhodecode/lib/utils.py

@@ -958,8 +958,10 b' class PartialRenderer(object):'
 
 
 def password_changed(auth_user, session):
-    if auth_user.username == User.DEFAULT_USER:
+    # Never report password change in case of default user or anonymous user.
+    if auth_user.username == User.DEFAULT_USER or auth_user.user_id is None:
         return False
+
     password_hash = md5(auth_user.password) if auth_user.password else None
     rhodecode_user = session.get('rhodecode_user', {})
     session_password_hash = rhodecode_user.get('password', '')