Require old password on change password endpoint

Require old password on change password endpoint #520