The vulnerablepassword_rest.php file could better be moved to an auto-loaded class - please refer to https://docs.moodle.org/dev/Automatic_class_loading