fixed a small bug (validate old password only on update); extracted user form to a partial (/users/_user.html.erb)