allow checkPassword to take a userId, changePassword requires a current password