You're checking against the list ["value"; "old"; "new"].
Please would you add "password" to that list? It might not be needed at present but its absence makes me nervous.

Without this patch, xapi logs lines like
xe user-password-change password=null old=thisistheoldpassword new=thisisthenewpassword username=root

Even though password is null there, I worry about what might happen in different circumstances or with future code-changes.