added 'current password' to allow user/settings update