Bad handling of old_password