fix: issue a login session only while the guest session and account password are unchanged

db/queries/members.sql

@@ -30,7 +30,11 @@ SELECT * FROM members WHERE username = @username;
 -- name: SetMemberPassword :execrows
 UPDATE members SET password_hash = @password_hash WHERE id = @id AND username IS NOT NULL;
 
--- name: DeleteSession :exec
+-- name: LockMemberPassword :one
+-- FOR SHARE 让修改密码等到这次登录提交之后，它随后删除会话时会删掉这次登录签发的会话。
+SELECT coalesce(password_hash, '')::text AS password_hash FROM members WHERE id = @id FOR SHARE;
+
+-- name: DeleteSession :execrows
 DELETE FROM member_sessions WHERE token_hash = @token_hash;
 
 -- name: DeleteMemberSessions :many