current password needed only for password change