[change] the user password can also be changed by clients

yeah, that's right. i think it's a tradeoff between being more expressive and duplicating some code. some ideas:

access token can be created in each calling method then passed on to the helper method `changePassword`. one could easily use 'extract method' to remove duplication.

i don't see a solution for the `oneTimePassword` check other than extracting it to a method, in there throw an exception if the check fails and let an exception mapper handle the rest (that's actually what should have been done in the first place anyway). but that's maybe too much for now. you can still duplicate the code. how likely is it, that the checking logic will ever change?