user ability to change password

Added a change password option to the profile page.

For added security the password is only changed once an email has been sent to the user and the confirmation link followed.