Thank you Tony.

This would mean that the password change service will have to be on a CSP application configuration which is unauthenticated by the underlying Cache web-service handler.

Another option may be to let the password never expire and perform peer certificate verification by issuing a certificate to the client and verifying it during the SSL/TLS handshake.
Is this possible in Cache on the CSP gateway in some way, on a User level or even on a CSP application configuration?