you might want to chain this with an `else if` to the previous if statement. You should not set a new random password, when the user just changed his password.