redirects non-logged-in-users to the password page when they try to change their passwords

for whatever reason we were sending 500s instead