when updating user accounts, password only required when updating email