Maybe we can have internal `_passwordChangeStart` and `_passwordChangeFInish` that we use for testing, and a public `passwordChange` that consumers use.