backend: only require password to update account if one exists