Question: What security measures should be taken when creating "change your password" functionality?