validate current password before change