Use the user who is changing their password rather than the request user.