require oldPassword when setting a new one