Change the password

Compare-and-swap against the hash just verified, so a change racing another loses instead of silently overwriting it. EVERY session dies, the caller's included: a password change cannot be distinguished from the response to a compromise, and the rule that is right in the second case is the one that applies to both.

curl -X POST "https://example.com/console/v1/password" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "email": "string",    "currentPassword": "string",    "newPassword": "stringstring"  }'