Code should be 409 and don't use 123 again

The code for the password change response was 205, which didn't really make sense, so it is now 409.

Also, there is a check now in the "update" to make sure they don't just use the default password again

Added some comments