API updates and some frontend testing

The testing is incomplete, but the few API changes are essential for the admin site.
Isn't the password and old_password, technically the same thing?