Use the configured value instead of a hard-coded one
Use proper service name (change-secret vs. change-password)
Log the underlying OAuth exception's details as well