As password tool use the context to redirect the user the it should be called on the current context.
Ex: If the user is changing his password in the context of a website the former code was redirecting to the root of ERP5. In the case the website had a dedicated url it was not noticeable.