Small usability improvements when changing passwords

Better strings, ask for the current password before the new password.
Also added more tests for UsersController.

refs #1410