Users must confirm their password before changing it