Along the same lines as the post about not redirecting to the login/logout in the profile section when the option is set not to use yaf for login/logout, there should be some manner to disable changes passwords in YAF as well or a redirection in the config.

The perspective is if someone is not using YAF to control login/logout, they probably have password changing capacity built into the master-site and perhaps some custom logic applied in the login/logout and/or password changes.

Agreed. I'll add.

Added in latest SVN.