Ensure change password page requires authentication

Fixes #1231