Fix security bug: everybody can update other users password