Require old password when user changes password
As a user I want to provide my old password when I change my password, so that a malicious user cannot change it when having access to my current session.
Currently I can change my password when I am logged in without providing the old one.