I would have use Exception instead of returning a status.
* `OldPasswordMismatchException`
* `PasswordNotChnagedException`
* `PasswordTooShortException`
* etc...

All these exceptions extend `PasswordException`.