620 change user password

closes #620
Could we use neither and get this from the authorization information?