Change password

Depends on #14 being merged first :-)
this is just the test, which is using a mocked version of setSession. in the actual code, it's only set in server.js (and then called with response.server.methods.setSession).

Actually, you just gave me a brilliant idea for how to share these mocks between all the tests!

Will do that now :-D