unauthenticated POST /auth/change_password returns {"ok":false,"why":"nick_or_email_missing"}

[indr]

$ curl -H 'Content-Type: application/json' \
> -d '{"password":"p","repeat":"p","nick":"email1","email":"email1"}' -v \
> http://localhost:3000/auth/change_password
*   Trying ::1...
* Connected to localhost (::1) port 3000 (#0)
> POST /auth/change_password HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.47.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 62
> 
* upload completely sent off: 62 out of 62 bytes
< HTTP/1.1 200 OK
< X-Powered-By: Express
< Content-Type: application/json
< Cache-Control: private, max-age=0, no-cache, no-store
< Content-Length: 42
< Date: Mon, 01 Aug 2016 12:31:40 GMT
< Connection: keep-alive
< 
* Connection #0 to host localhost left intact
{"ok":false,"why":"nick_or_email_missing"}

The error message is misleading, because email and/or nick is sent.