What if the user comes from somewhere other than `request.user`.  What if I wanna use this to change someone else's password using this view.