check old password before creating new password

Verify that userstatus is 'user'.  Without this check, the script resets the user password without verifying that the old password is correct.