change-password: add /password_change route that reauths with HS

Instead of emailing users with a link to change their passwords (which would require celery and email and what not), their is now and option for any user to reauth with HS and will change their password to their *new* HS password. Seemed like a reasonable solution given the relatively heavy lifting the email solution would require. I tested it locally and worked as expected, but wasn't sure how to write a test case.

(Also, Emacs makes me look like an asshole, deleting all those tabs and newlines at the end of the file... not trying to nitpick!)