Changing password should confirm the old password

web/src/app/AccountApi.js

@@ -120,17 +120,20 @@ class AccountApi {
         }
     }
 
-    async changePassword(newPassword) {
+    async changePassword(currentPassword, newPassword) {
         const url = accountPasswordUrl(config.base_url);
         console.log(`[AccountApi] Changing account password ${url}`);
         const response = await fetch(url, {
             method: "POST",
             headers: withBearerAuth({}, session.token()),
             body: JSON.stringify({
-                password: newPassword
+                password: currentPassword,
+                new_password: newPassword
             })
         });
-        if (response.status === 401 || response.status === 403) {
+        if (response.status === 400) {
+            throw new CurrentPasswordWrongError();
+        } else if (response.status === 401 || response.status === 403) {
             throw new UnauthorizedError();
         } else if (response.status !== 200) {
             throw new Error(`Unexpected server response ${response.status}`);
@@ -394,6 +397,12 @@ export class AccountCreateLimitReachedError extends Error {
     }
 }
 
+export class CurrentPasswordWrongError extends Error {
+    constructor() {
+        super("Current password incorrect");
+    }
+}
+
 export class UnauthorizedError extends Error {
     constructor() {
         super("Unauthorized");