It would have helped if I had formatted the body correctly - it should be:
body: JSON.stringify({
"currentPassword": oldPasswordInput.value,
"password": newPasswordInput.value,
"passwordConfirmation": confirmPasswordInput.value
})
currentPassword, password & passwordConfirmation have to be in quotes, sigh…