core/src/main/java/org/sakaiproject/nakamura/lite/authorizable/AuthorizableManagerImpl.java
public void changePassword(Authorizable authorizable, String password, String oldPassword) throws StorageClientException,
            AccessDeniedException {
        long t = System.currentTimeMillis();
        try {
            String id = authorizable.getId();

            if (thisUser.isAdmin() || currentUserId.equals(id)) {
                if (!thisUser.isAdmin()) {
                    User u = authenticator.authenticate(id, oldPassword);
                    if (u == null) {
                        throw new IllegalArgumentException("Unable to change passwords, old password does not match");
                    }
                }
                putCached(keySpace, authorizableColumnFamily, id, ImmutableMap.of(Authorizable.LASTMODIFIED_FIELD,
                        (Object) System.currentTimeMillis(), Authorizable.ID_FIELD, id, Authorizable.LASTMODIFIED_BY_FIELD,
                        accessControlManager.getCurrentUserId(), Authorizable.PASSWORD_FIELD,
                        StorageClientUtils.secureHash(password)), false);

                storeListener.onUpdate(Security.ZONE_AUTHORIZABLES, id, currentUserId, getType(authorizable), false, null,
                        "op:change-password");

            } else {
                throw new AccessDeniedException(Security.ZONE_ADMIN, id,
                        "Not allowed to change the password, must be the user or an admin user", currentUserId);
            }
        } finally {
            statsService.apiCall(AuthorizableManagerImpl.class.getName(), "changePassword", System.currentTimeMillis() - t);
        }

    }
public void changePassword(Authorizable authorizable, String password, String oldPassword) throws StorageClientException,
            AccessDeniedException {
        long t = System.currentTimeMillis();
        try {
            String id = authorizable.getId();

            if (thisUser.isAdmin() || currentUserId.equals(id)) {
                if (!thisUser.isAdmin()) {
                    User u = authenticator.authenticate(id, oldPassword);
                    if (u == null) {
                        throw new IllegalArgumentException("Unable to change passwords, old password does not match");
                    }
                }
                putCached(keySpace, authorizableColumnFamily, id, ImmutableMap.of(Authorizable.LASTMODIFIED_FIELD,
                        (Object) System.currentTimeMillis(), Authorizable.ID_FIELD, id, Authorizable.LASTMODIFIED_BY_FIELD,
                        accessControlManager.getCurrentUserId(), Authorizable.PASSWORD_FIELD,
                        StorageClientUtils.secureHash(password)), false);

                storeListener.onUpdate(Security.ZONE_AUTHORIZABLES, id, currentUserId, getType(authorizable), false, null,
                        "op:change-password");

            } else {
                throw new AccessDeniedException(Security.ZONE_ADMIN, id,
                        "Not allowed to change the password, must be the user or an admin user", currentUserId);
            }
        } finally {
            statsService.apiCall(AuthorizableManagerImpl.class.getName(), "changePassword", System.currentTimeMillis() - t);
        }

    }
TODO: Unit test