Where it is allowed, users data can be modified without reenteing the password. Bug solved.