The user should have to put his password in order to change any of his account settings.