For consistency sake, we should do the check on currentPassword first, and do the check on newPassword