resolves #40: require valid current password when changing email address