require password for updating users