CB Login successful once then fails

Just upgraded a working Joomla 2.5.14 site to joomla 2.5.28; CB 1.9
A user requested a new password; from then on they have been unable to login; Their CB user record (opened from user management list) shows their password (hashed) once, which is not the norm. If I copy the password into the 'verify password field and save the record, the user can login, but only once. the next time they see an 'Incorrect username or password. Please try again.' message.
I now discover that the same applies to my superuser record; I see the password in the password field and by copying it I can login to the front end; otherwise I see the same error essage; I have no problem logging into the back end.

We do not support CB 1.x anymore. I've no idea what your issue could be, but it's likely an incompatibility between Joomla 2.5.x and CB 1.x. Forgot Login is working fine with CB 2.x.

using the extensions >update route Joomla 2.5.28 updated my CB to 1.9.1, which seems to have fixed the problem; I then tried to update to CB 2, downloading pkg_communitybuilder_2.0.14+build.2016.06.29.00.16.20.56df57006.zip; when attempting to install this I received an error 'Failed to uninstall self. Please uninstall manually.' is this the normal process and exactly how should I 'uninstall self'?
I then tried unpacking and uploading to /tmp folder and installing from there (as suggested in the CB manual) as far as I could tell this installed the component 'phocadownload' which generated a fatal error;

CB 1.x to CB 2.x is not an upgrade. It is a migration. Do not install it on a live site. Clone your site then install it on a clone so you're prepared for any issues that may come from the migration.

The failed to uninstall self means the package installer couldn't remove it self. You'll need to uninstall the package installer manually within Extensions > Manage. This is not normal and should not happen; the log at the bottom should have an error output if an error occurred.

There's no way it installed phocadownload, that's a 3rd party extension.