The current 7.x-1.0 release uses D6's hook_perm and not D7's hook_permission. As a result, no one has permission to change their password. 7.x-1.x-dev uses the correct hook. A new tag / release should be created so that the recommended production version actually works.