Change the Password in Go

Users must be able to change their password, for instance when they think someone saw it. The route is PUT /me/password: PUT because it replaces a value the user already has, and /me because it is about the logged-in user. It is wrapped in loginRequired, so the function receives user.

Changing a value of "me": the same pattern works for any value of the logged-in user. Here is a route that changes the user's email:

app.HandleFunc("PUT /me/email", loginRequired(changeEmail))

func changeEmail(w http.ResponseWriter, r *http.Request, user User) {
	var data map[string]string
	json.NewDecoder(r.Body).Decode(&data)
	db.Exec("UPDATE users SET email = ? WHERE id = ?", data["email"], user.ID)
	writeJSON(w, 200, map[string]string{"email": data["email"]})
}

A password needs three more safety rules. Ask for the old password and check it against the stored hash: a stolen token, or a laptop left logged in, must not be enough to take the account, so a wrong old password gets 403. Store only the hash of the new password. Then delete all the user's tokens and clear the session cookie: every device, this one too, must log in again with the new password.

Ana is logged in twice: on her phone with the token <phone> and on her laptop with <token>. Your code must give these answers, in this order:

PUT /me/password  {"old_password": "guess123", "new_password": "newsecret456"}   (Bearer <token>)
    →  403  {"error": "Wrong password"}
PUT /me/password  {"old_password": "secret123", "new_password": "newsecret456"}  (Bearer <token>)
    →  200  {"message": "Password changed, please log in again"}
GET /me  (Bearer <phone>)  →  401  {"error": "Login required"}
GET /me  (Bearer <token>)  →  401  {"error": "Login required"}
POST /login  {"email": "ana@example.com", "password": "secret123"}     →  401  {"error": "Wrong email or password"}
POST /login  {"email": "ana@example.com", "password": "newsecret456"}  →  200  {"token": "<new>"}
GET /me  (the new login's session cookie)  →  200  {"email": "ana@example.com", "id": 2, "role": "customer"}

Your task: below logout, add PUT /me/password behind loginRequired. Answer {"error": "Wrong password"} with 403 when the old password doesn't match. Otherwise store the new password's hash, delete all the user's tokens, clear the session cookie and answer {"message": "Password changed, please log in again"}.

Assignment
Follow the Coding Tutorial to build the changePassword handler, one safety rule at a time.

Hint
user has no password hash in it: scan it with SELECT password_hash FROM users WHERE id = ?. After the 403, return, or a wrong old password would go on and change the password. Delete the tokens with WHERE user_id = ?, not WHERE token = ?, so every device is logged out.