Q:

At what level should I unit test? 

Let's say in my user model I have a ChangePassword method.  Given an already initialised user model, it takes the new password as a parameter and does the database work to make the magic happen.  The front end to this is a web form, where the user enters their current password and their desired new password.  The controller then checks to see if the user's current password is correct.  If so, it invokes the user model's ChangePassword method.  If not, it displays an error to the user. 
From what I hear you're supposed to unit test the smallest piece of code possible, but doing that in this case completely ignores the check to make sure the user entered the correct current password.  So what should I do? 
Should I:
A) Unit test only from the controller, effectively testing the model function too? 
OR
B) Create 2 different tests; one for the controller and one for the model? 

A:

When in doubt, test both.  If you only test the controller and the test fails, you don't know whether the issue is in the controller or the model.  If you test both, then you know where the problem lies by looking at the model's test result - if it passes, the controller is at fault, if it fails, then the model is at fault.