add test to confirm that not providing the right password to change password yields a 401
return 403 if change password passed invalid current password