require the password when removing an account (/unregister) #2