Allows users to change their password

Since it's only going to serve html for now, why not remove the json part? We can add it back if needed and at least if that day never comes we won't have this code here that's not used.