A session token is no longer required in a server response
Added code to test changing user password