'Provides a form with which one can change their password.  If token is
provided, don\'t require current password.'

@web.expose
def change_password(self, trans, token=None, **kwd):

    status = None
    message = kwd.get('message', '')
    user = None
    if kwd.get('change_password_button', False):
        password = kwd.get('password', '')
        confirm = kwd.get('confirm', '')
        current = kwd.get('current', '')
        token_result = None
        if token:
            token_result = trans.sa_session.query(trans.app.model.PasswordResetToken).get(token)
            if (token_result and (token_result.expiration_time > datetime.utcnow())):
                user = token_result.user
            else:
                return trans.show_error_message('Invalid    or    expired    password    reset    token,    please    request    a    new    one.')
        else:
            (ok, message) = trans.app.auth_manager.check_change_password(trans.user, current)
            if ok:
                user = trans.user
            else:
                status = 'error'
        if user:
            message = validate_password(trans, password, confirm)
            if message:
                status = 'error'
            else:
                user.set_password_cleartext(password)
                if token_result:
                    trans.handle_user_login(token_result.user)
                    token_result.expiration_time = datetime.utcnow()
                    trans.sa_session.add(token_result)
                for other_galaxy_session in trans.sa_session.query(trans.app.model.GalaxySession).filter(and_((trans.app.model.GalaxySession.table.c.user_id == user.id), (trans.app.model.GalaxySession.table.c.is_valid == true()), (trans.app.model.GalaxySession.table.c.id != trans.galaxy_session.id))):
                    other_galaxy_session.is_valid = False
                    trans.sa_session.add(other_galaxy_session)
                trans.sa_session.add(user)
                trans.sa_session.flush()
                trans.log_event('User    change    password')
                if (kwd.get('display_top', False) == 'True'):
                    return trans.response.send_redirect(url_for('/', message='Password    has    been    changed'))
                else:
                    return trans.show_ok_message('The    password    has    been    changed    and    any    other    existing    Galaxy    sessions    have    been    logged    out    (but    jobs    in    histories    in    those    sessions    will    not    be    interrupted).')
    return trans.fill_template('/webapps/tool_shed/user/change_password.mako', token=token, status=status, message=message, display_top=kwd.get('redirect_home', False))
