I figured out the reasons now, it is because the backend running Memcached process. It seems the old username/password is cached in memory, so after changing the password and try to login immediately, it failed to login. If I kill the memcached process and get it restarted, the use successfully login.
Now the problem is how to fix it, I’ve to keep memached running for a better performance, but it surly will be a problem for new changed password accounts. Is there someone else having this problem?