Don't reveal whether user exists when not authenticated

Also add spec for testing reaction when user is not allowed to change the password.