password update now checks and requires old password.