Added functionality to change a users password and a session token is no longer necessarily sent with a response