code: func (h *Handler) u2fChangePasswordRequest(w http.ResponseWriter, r *http.Request, _ httprouter.Params, ctx *SessionContext) (interface{}, error) {
  	var req *client.U2fSignRequestReq
  	if err := httplib.ReadJSON(r, &req); err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	clt, err := ctx.GetClient()
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	u2fReq, err := clt.GetU2FSignRequest(ctx.GetUser(), []byte(req.Pass))
  	if err != nil && trace.IsAccessDenied(err) {
  		// logout in case of access denied
  		logoutErr := h.logout(w, ctx)
  		if logoutErr != nil {
  			return nil, trace.Wrap(logoutErr)
  		}
  	}
  
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return u2fReq, nil
  }
docs: // u2fChangePasswordRequest is called to get U2F challedge for changing a user password