Password gets set for admin not for user with id in path

Build: local build
Latest Commit: 3c3d3c2d03ee7266ee0b815e0f25f4262e605147

*Use Case*

Trying to create a new user with password through cypress as per swagger

```javascript
cy.signin().then(({body}) => {
cy.request('POST', 'api/v2/users', {name: 'nicholas' })
.then((resp) => {
cy.request({
method: 'PUT',
url: 'api/v2/users/' + resp.body.id + '/password',
auth: {
user: 'u1',
password: 'password'
},
body: {
password: 'changeit'
}
})
})

})

```

This returns the following response in the test

```
PUT 204 http://localhost:9999/api/v2/users/03b57743de621000/password
...
{status: 204, duration: 159, headers: {…}}
duration: 159
headers:
connection: "close"
date: "Tue, 16 Apr 2019 11:40:08 GMT"
__proto__: Object
status: 204
__proto__: Object
```
However, when I try and log in through the UI two things happen.

1. Login as `nicholas:changeit` returns 401 - O.K. so maybe need to setup an authorization record
1. _More troubling_ The admin user `u1`, created during setup, has his password changed to `changeit`

*Related Issue*
#11590

Start with the PUT api/v2/users/:id/password endpoint and reproduce the behavior using the Cypress request shown in the issue. Compare the password target for the user in the path with the authenticated admin user, and use related issue #11590 for context. Done means the path user’s password changes without changing the admin password, with the reported login behavior verified.

Written by the indexing model from the issue text.