Edit profile page with password change fields

Possible improvements:
- Redirecting back to a page other than the referer
- Choosing layouts to match the calling site
This probably happens to work, but really `authorized?` is supposed to return true (if authorized) or false (if not authorized) instead of raising an exception.  This works because the code that calls `authorize?` is going to raise an exception anyway.

Instead, this and the other uses below should be using `OSU::AccessPolicy.action_allowed?(:update, caller, caller)`

See https://github.com/lml/lev/blob/master/lib/lev/handler.rb#L198