A.16 XEP-0077 (In-Band Registration)

In-band registration is supported for all purposes. That means registering a new Jabber account, changing Jabber password, removing a Jabber account, registering with a service, and cancelling registration to a service. Data forms are supported as well. URL redirections are not.

jabber.el will not prevent or alert a user trying to change a password over an unencrypted connection.