API method: user.changePassword(old, new).