mendozal Thanks! You are right.
I will update my Github soon with this new information. The customer's RoundCube does not contain these variables anywhere within the installation, so they must be set in config.inc.php
in order for the customer to change the password.
tobias I will add this to my feature list as I think that's a good security enhancement!