test for changing password

related to #475 and #478 
@bamnet (it didn't work, so I had to nuke the request and the branch).  Here it is, much more concise.  What an exercise.  Let me know if there's anything you want me to change.