[change] the user password can also be changed by clients

all you do here is switching on a parameter and getting the user like [this](https://github.com/osiam/addon-self-administration/pull/54/files#diff-6a6b2bf8cadc34a8b0b418a3f12005ffR268) or like [that](https://github.com/osiam/addon-self-administration/pull/54/files#diff-6a6b2bf8cadc34a8b0b418a3f12005ffR270).

why don't you just get the user in the calling method? after all the calling method should decide what things have to be done and this rather generic method should just check the preconditions and update the given user.