#59: expose the setPassword API to /api/users/password