/users/password: return 403 on auth failure

docs/authentication.rst

@@ -123,3 +123,4 @@ Use the following request body:
     }
 
 Send the user's current password in ``old``, and Sachet will change it to the password in ``new``.
+If the password is wrong, Sachet will return a ``403``.

sachet/server/users/views.py

@@ -117,7 +117,7 @@ class PasswordAPI(MethodView):
                         "message": "Invalid 'old' password.",
                     }
                 ),
-                400,
+                403,
             )
         else:
             auth_user.password = auth_user.gen_hash(new_psswd)