separate change password/reset password logic, refactor validators, add current password to change password form