url(r'^profile/(?P<username>[-w.]+)/$', views.profile, name='profile'),
url(r'^password_change/(?P<username>[-w.]+)/$', views.password_change, name='password_change'),
url(r'^password_change_done/$', views.password_change_done, name='password_change_done'),

oldpassword = forms.CharField(max_length = 20, widget=forms.TextInput(attrs={'type':'password', 'placeholder':'your old Password',  'class' : 'span'}))
newpassword1 = forms.CharField(max_length = 20, widget=forms.TextInput(attrs={'type':'password', 'placeholder':'New Password',  'class' : 'span'}))
newpassword2 = forms.CharField(max_length = 20, widget=forms.TextInput(attrs={'type':'password', 'placeholder':'Confirm New Password',  'class' : 'span'}))

class Meta:
    model = User
    fields = ("username",)
    field_classes = {'username': UsernameField}

def __init__(self, *args, **kwargs):
    super().__init__(*args, **kwargs)
    if self._meta.model.USERNAME_FIELD in self.fields:
        self.fields[self._meta.model.USERNAME_FIELD].widget.attrs.update({'autofocus': True})

def clean(self):
    if 'newpassword1' in self.cleaned_data and 'newpassword2' in self.cleaned_data:
        if self.cleaned_data['newpassword1'] != self.cleaned_data['newpassword2']:
            raise forms.ValidationError(_("The two password fields did not match."))
        return self.cleaned_data

def save(self, commit=True):
    user = super().save(commit=False)
    user.set_password(self.cleaned_data["password1"])
    if commit:
        user.save()
    return user

@login_required
def password_change(request, username):
if request.method == 'POST':
    form = PasswordChangeForm(data=request.POST, user=request.user)
    print("username is "+username)

    if form.is_valid():
        #form.save()
        update_session_auth_hash(request, form.user)
        form.save()
        print("A")
        return HttpResponseRedirect('/blog/password_change_done/')
    else:
        update_session_auth_hash(request, form.user)
        form.save()
        print("B")
        return redirect(reverse('blog:profile', args=[form.user.get_username()]))
else:
    print("C")
    form = PasswordChangeForm(user=request.user)#unbound
    return redirect(reverse('blog:profile', args=[form.user.get_username()]))

<h2>password change</h2>
{% if error_message %}
<p><strong>{{ error_message }}</strong></p>
{% else %}
{% endif %}
<form class="form-horizontal" role="form" action="{% url 'blog:password_change' user.username %}" method="post" enctype="multipart/form-data">
    {% csrf_token %}
    {{ form.as_p }}
    <button type="submit" class="button-primary">password change</button></div>
</form>