Change password

Depends on #14 being merged first :-)
There should be more tests here against bad data -- crappy usernames, invalid data of various kinds.