diff --git a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/PasswordServlet.java b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/PasswordServlet.java
index 141a0ae06aff7ba1cd6b204b43fc60761cb1b2f3..5d07ea7147d9581fe140c98956454362652f750e 100644
--- a/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/PasswordServlet.java
+++ b/projects/cadcAccessControl-Server/src/ca/nrc/cadc/ac/server/web/users/PasswordServlet.java
@@ -70,7 +70,6 @@ package ca.nrc.cadc.ac.server.web.users;
 
 import java.io.IOException;
 import java.security.AccessControlException;
-import java.security.PrivilegedAction;
 import java.util.Set;
 
 import javax.security.auth.Subject;
@@ -87,15 +86,30 @@ import ca.nrc.cadc.auth.HttpPrincipal;
 import ca.nrc.cadc.log.ServletLogInfo;
 import ca.nrc.cadc.util.StringUtil;
 
-@SuppressWarnings("serial")
+
+/**
+ * Servlet to handle password changes.  Passwords are an integral part of the
+ * access control system and are handled differently to accommodate stricter
+ * guidelines.
+ * <p/>
+ * This servlet handles POST only.  It relies on the Subject being set higher
+ * up by the AccessControlFilter as configured in the web descriptor.
+ */
 public class PasswordServlet extends HttpServlet
 {
     private static final Logger log = Logger.getLogger(PasswordServlet.class);
+
+
     /**
      * Attempt to change password.
+     *
+     * @param request  The HTTP Request.
+     * @param response The HTTP Response.
+     * @throws IOException Any errors that are not expected.
      */
-	public void doPost(final HttpServletRequest request, final HttpServletResponse response)
-        throws IOException
+    public void doPost(final HttpServletRequest request,
+                       final HttpServletResponse response)
+            throws IOException
     {
         final long start = System.currentTimeMillis();
         final ServletLogInfo logInfo = new ServletLogInfo(request);
@@ -103,69 +117,51 @@ public class PasswordServlet extends HttpServlet
         try
         {
             final Subject subject = AuthenticationUtil.getSubject(request);
-            if ((subject == null) || (subject.getPrincipals(HttpPrincipal.class).isEmpty()))
+            if ((subject == null)
+                || (subject.getPrincipals(HttpPrincipal.class).isEmpty()))
             {
                 logInfo.setMessage("Unauthorized subject");
                 response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
             }
             else
             {
-                logInfo.setSubject(subject);		        
-                Subject.doAs(subject, new PrivilegedAction<Void>()
+                logInfo.setSubject(subject);
+                final Set<HttpPrincipal> webPrincipals =
+                    subject.getPrincipals(HttpPrincipal.class);
+                final User<HttpPrincipal> user =
+                    new User<HttpPrincipal>(webPrincipals.iterator().next());
+                String oldPassword = request.getParameter("old_password");
+                String newPassword = request.getParameter("new_password");
+                if (StringUtil.hasText(oldPassword))
                 {
-                    @Override
-                    public Void run()
+                    if (StringUtil.hasText(newPassword))
+                    {
+                        (new LdapUserPersistence<HttpPrincipal>())
+                            .setPassword(user, oldPassword, newPassword);
+                    }
+                    else
                     {
-                        try
-                        {
-                            final Set<HttpPrincipal> webPrincipals =
-                            subject.getPrincipals(HttpPrincipal.class);
-				
-                            User<HttpPrincipal> user = new User<HttpPrincipal>(webPrincipals.iterator().next());
-                            String oldPassword = request.getParameter("old_password");
-                            String newPassword = request.getParameter("new_password");
-                            if (StringUtil.hasText(oldPassword))
-                            {
-                                if (StringUtil.hasText(newPassword))
-                                {
-                                    (new LdapUserPersistence<HttpPrincipal>()).setPassword(user, oldPassword, newPassword);
-                                }
-                                else
-                                {
-                                    throw new IllegalArgumentException("Missing new password");
-                                }
-                            }
-                            else
-                            {
-                                throw new IllegalArgumentException("Missing old password");
-                            }
-                        }
-                        catch (IllegalArgumentException e)
-                        {
-                            log.debug(e.getMessage(), e);
-                            logInfo.setMessage(e.getMessage());
-                            response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
-                        }
-                        catch (AccessControlException e)
-                        {
-                            log.debug(e.getMessage(), e);
-                            logInfo.setMessage(e.getMessage());
-                            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
-                        }
-                        catch (Throwable t)
-                        {
-                            String message = "Internal Server Error: " + t.getMessage();
-                            log.error(message, t);
-                            logInfo.setSuccess(false);
-                            logInfo.setMessage(message);
-                            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
-                        }
-			            
-                        return null;
+                        throw new IllegalArgumentException("Missing new password");
                     }
-                });
+                }
+                else
+                {
+                    throw new IllegalArgumentException("Missing old password");
+                }
             }
         }
+        catch (IllegalArgumentException e)
+        {
+            log.debug(e.getMessage(), e);
+            logInfo.setMessage(e.getMessage());
+            response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
+        }
+        catch (AccessControlException e)
+        {
+            log.debug(e.getMessage(), e);
+            logInfo.setMessage(e.getMessage());
+            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+        }
         catch (Throwable t)
         {
             String message = "Internal Server Error: " + t.getMessage();