I would suggest looking at the more complicated login modules. In particular the database login module would help. You can retrieve the authentication information from a database table that stores usernames and passwords.
To let someone change the password, you could write a servlet or some other app to allow them to update the database information with their new password.
Hopefully this helps!