Steps to reproduce the issue

Noticed in latest 3.9.28 there is a new function to destroy user session if password or block has been changed.

Problem is that the 'password' always contains a string, so it will always destroy the session. It should be using the 'password2' variable that is only set on password changes.

Expected result

Change a user in backend, and frontend session should not get destroyed when not changing password or blocking user.

Actual result

Session always get destroyed.

System information (as much as possible)

Joomla 3.9.28
Php 7.4.20

Additional comments