REST API vs SOAP on iMIS

I'd like to make a comparison between how we use REST API and SOAP for iMIS integration.

From what I see REST API is for accessing global resources like events. While SOAP is for user-specific resources/activities, such as updating password, updating profile, etc.

If we use SSO to let users sign on our website, we can have their token for generic activities. Then if the user wants to update their profile, we need to ask them password again to be able to login SOAP?