Don't require users to type their password to change any setting. Just require them to type their old password to set a new password.