I understand that this cannot be handled in `form.save()` because the form doesn't know about the request.

However, it would be nice to factor it into a public function for people defining their own password change forms.