Fix #25: Actually use "current password" in user settings

Also adds sync version of `User#comparePassword`