return 401 to failed login request
check current password when updating password