Change password: fix auth.

`old_pwd` was already hashed -> straight db request, without hashing it.