validate old password before changing