on the toolbar in the right side, under the "current user" section, the "change password" link is always displayed, even if the user does not have the permission to change it.
that link should only be visible if the user has the permission to change his own password.