Require old password when updating user