Update vboxadm.php

The vboxadm-api requires a (non-empty) password for each request. But it only needs the correct password for a password-change.
Changes to the vacation responder and spam-assassin technically don't require (correct) password but they still return a "login failed" error if the current-password is empty