Why would the old password be null in the first place, this seems like an invented scenario