add ability to change password

[benadida]

No description provided.

[lloyd]

reassigned to @shane-tomlinson

we need some UX feedback here.

[skinny97214]

We'll need to re-auth. This form has old pass/new pass. I'm omitting the confirm password field.

http://cl.ly/1N2G2a2K1l143F0j1F1e
http://cl.ly/0l3Q0j3N3x381T3D2b3i

[shane-tomlinson]

@lloyd - update_password is returning "success: true" no matter what the oldpass is. Bad jiji.

POST:

csrf    f588271cf2aa2228afaa82ad96d0f511
newpass newpassword
oldpass jibberish

RESPONSE:

{"success":true}

POST:

csrf    f588271cf2aa2228afaa82ad96d0f511
newpass anothernewpass
oldpass morejibberish

RESPONSE:

{"success":true}

[shane-tomlinson]

Reopening, passing to @lloyd for above comment - #114 (comment)

[ghost]

Verified on Windows XP + IE8.

When there are multiple email addresses associated to a BID account, only the email address used to reset the password is kept after changing the password from the a client.

[ghost]

Verified as fixed on Windows XP + IE8 when using the manage page.