sharing, allow user to disable password protection

only remember the old password if the user changes the permissions, otherwise the user disabled the password protection. In this case the password should be set to null.