You're not checking that the current_password is good.