Issue 624

Talked with @antgonza, the SQL modifications in this PR to the user object's `_change_pass` function should take care of this; this was not reflected in my test because the code was not deployed on qiita.colorado.edu