Fixed the user validation to only require password if changing