test changePassword as someone who isn't admin or the user for whom the password is being changed
test that external auth redirects to appropriate host
test admin invalid password change
test associateLoginId with user that doesn't exist
test changing password on an user with no local auth strategy