Password change protocol rework, round 2

[Sam Hartman]

I'm not really happy with the complexity of a reply cache on the
server but I cannot think of another solution so I believe it is
necessary.