SITE_USER_PASSWORD_MANAGE SITE Endpoint
  /rpc/site/?method=SITE_USER_PASSWORD_MANAGE  
  For a user to update their password - typically used in members website on the members profile.

Obviously you need to transfer this data over SSL. Also make sure you have a check in the client to make sure newpassword has been typed in twice. You can configure Password options in SETUP_SPACE_SETTINGS_MANAGE.
 
  PARAMETERS TYPE NOTES
  Site Numeric Mandatory
  NewPassword Text Mandatory.
  CurrentPassword Text Mandatory.
  ExpireDays Numeric Days until password expires [Default: 180]. If a value has been set via SETUP_SPACE_SETTINGS_MANAGE, then this parameter is ignored
  RETURN  
  notes UPDATED
  url Useful if password being changed as part of logon process.
  sid