change user auth interface for changePassword

method now takes the old password as well as the new one