add current_password confirmation & test