No need to check for isClientAuthenticated in changePasswordWithOldPassword