Hi Chris,
You want to use "session_user".
> I would expect this to change the password of the user currently
> logged in but instead it changes MY password. Evidently when a
> function is called which is set to SECURITY DEFINER, it changes the
> context of the current user. The CURRENT_USER then returns the name
> of the definer rather than the invoker of the function.
>
> So this being said-- are there any workarounds that don't allow anyone
> to change anyone else's password?
Cheers