[FIX] web: user's change_password wizard

Auth can now report errors less trivial than "incorrect password", the
wizard should report them instead of just assuming the original
password was not correct.