This should require the token. Otherwise a user can change their password without making a forgot password request and without writing their old password, which is something we require in the change password feature of settings. This is a security problem.