Instead of throwing a BadCredentialsException here (which means it has to be catched in the CurrentPasswordValidator to avoid getting a 500 error when applying the validator, which is not done currently), wouldn't it be better to return false in ``isPasswordValid`` ? This method has 2 different way to handle invalid passwords now