The problem is not the client but the new structure of the server. Citrix does no longer support the direct access to the published apps.
Therefore you do need the PNAgent connection as you have configured it already for testing.
Password changing isn’t an issue here at all.
I have posted a short document in the Products section which explains what to do, to get users the ability to change their expired passwords.
CG