need a partial rewrite of the logic in change_password.php
It might be IMHO better to allow password changing only when already logged in - it would make it easier to implement and easier to use for ordinary users.

Basic accessibility should be already fixed.