Revisit #19: require the user to type in his
current password no matter what his admin
status is.