[change] the user password can also be changed by clients

i think it's ok for now, because we need to make refactoring for the LostPassword- and ChangeEmailController anyway.