Fix exploit where success was shown also if the password wasn't changed