Added change password to user resource.
Ripped out remaining auth-via-HTML code and moved tests to API.