fixed change password for editProfile

The original password was never checked, so even if the old
password is incorrect, the user can still change their password.
The problem was the hash function was used on the boolean instead
of the "old_password" from the form and the $this->Auth->user
did not return the password.