Page Comparison

...

Currently the reason field in ErrorResponse is reserved for a human-readable error message. We should also introduce an additonal additional field errorCode that defines an Enum which the clients can use to decide how it would like to handle the error.
For example, in the case of the password change required:

HTTP ERROR 401
{
    "reason":"You must first change your password!"
    "errorCode": "PASSWORD_CHANGE_REQUIIREDREQUIRED"
}

1. User logs in via the POST /login API with a username/password
2. Check that the user's password is not in our list of known, common passwords.
3. If it is, still return with HTTP 401 Unauthourized Unauthorized and respond with an ErrorResponse object that contains an errorCode.
4. clientsClients, upon seeing the errorCode, should redirect to page for changing password.

...

Currently, our POST /user/password takes

{

   "sessionToken": "<user session token>",
   "password": "myNewPassword"
}

...

EmailResetChangePassword for changing passwords via email. This would use a signed token to authorize the password change

{
    "authourizationauthorization" : {
         "username": "AzureDiamond"
         "expiresOn": 12345678,
         "signature": "<HMAC signature>"
    },
    "newPassword": "hunter3"
}

...