Removed window.host from many ajax requests - was generating odd
requests.
Client side support for changing passwords.