Only correct user can update password