old password is now required to change settings (+ bugfix)