Looks like the javadoc on UserService.changePassword is deceptive that it is Restricted to Super User access