With AuthForm, require the current user's password, not target

Only relevant with superuser.  Nasty casts.