In stead of making the link a direct link to the change password page, turn the link into a javascript call that submits the form
<a href="javascript://" onClick="document.yourform.submit(); return false;">change password</a>
Make the form submit to your change password page.
In addition to get parameters passed to a page/servlet you should use the request.getParameter() method and not request.getAttribute() one.
See http://java.sun.com/j2ee/1.4/docs/api/javax/servlet/http/HttpServletRequest.html
You can test this by calling your target jsp page directly and adding the parameters to the URL.
e.g.
http://localhost/app/changePassword.jsp?UNAME=name&PASSWORD=mypassword
In your changePassword.jsp you can then get the values by calling
request.getParameter("UNAME");
request.getParameter("PASSWORD");