Added check when user changes password, that sent old password is correct. This didn't lead into an exposure of critical data, since the data is encrypted on the client with the password. But a malicious attacker could delete or get to *encrypted* data.
Merge pull request #1 from erikdiessel/add-check-password-change

Merging the security fix: "Old password is checked before new is set".