User password

  1. How can I prevent a user from changing his password through curl in elasticsearch?
  2. How to track from what height the password in elasticsearch was changed using curl?