fixed POST action
Added editPassword.php form. 
Works for the current user, requires existing password to edit.

The page is not yet linked from anywhere.